feat: add local Docker scenario deployment

README.md

@@ -38,8 +38,18 @@ uv run python -m goe.build --spec tests/fixtures/entities/sqli_express.yaml
 # Re-test a generated output directory without model calls.
 uv run goe test output/<run_id>/
 
+# Deploy a validated package persistently to the local Docker daemon.
+uv run goe deploy docker output/<run_id>/
+
+# Inspect or tear down the local deployment.
+uv run goe status output/<run_id>/
+uv run goe destroy output/<run_id>/
+
 # Run the fast test suite.
 uv run pytest -m "not docker and not llm"
 ```
 
 See [the v2 specification](docs/architecture/v2_spec.md), [entity graph model](docs/architecture/entity_graph_model.md), and [code architecture](docs/architecture/v2_code_architecture.md) for the architecture and workflow details.
+
+See [local Docker deployment](docs/docker_deployment.md) for provisioning behavior,
+port exposure, status inspection, and cleanup.

docs/architecture/v2_code_architecture.md

@@ -597,7 +597,7 @@ flowchart TD
 
 `RunState` is checkpointed as `output/.checkpoints/<run_id>/state.json` after planning and after each terminal entity outcome, then after L3. It persists the original request, full graph, completed snapshots (deploy script, serialized procedure, outgoing values, attempts), failures, and chain-test result. Resume restores completed entities into the scheduler before new work starts, which re-establishes concrete value propagation.
 
-The package contains `deploy.sh` for a single-system case, or per-system scripts and `docker-compose.yml` for multi-system cases. It always includes `playbook.yaml`; it includes `chain_playbook.yaml` when L3 produced a chain procedure. The replay CLI deploys these outputs into fresh test containers and executes the saved procedure(s), making it the post-package test path without new model calls.
+The package contains `deploy.sh` for a single-system case or per-system scripts for a multi-system case, plus `docker-compose.yml` in both cases. It always includes `playbook.yaml`; it includes `chain_playbook.yaml` when L3 produced a chain procedure. The replay CLI deploys these outputs into fresh test containers and executes the saved procedure(s), making it the post-package test path without new model calls. The local Docker deploy lifecycle starts the Compose project persistently, waits for script-backed readiness checks, and records state under `.docker/` for status and teardown.
 
 ## 10. Completion conditions and model-call inventory
 

docs/docker_deployment.md

@@ -0,0 +1,46 @@
+# Local Docker deployment
+
+GoE packages can be deployed as persistent local environments with Docker Compose v2.
+This is separate from `goe test`, which creates a temporary validation environment and
+tears it down after the replay finishes.
+
+## Requirements
+
+- Docker Engine or Docker Desktop with the `docker compose` command
+- Local capacity to run one Ubuntu container per scenario system
+- The `goe-attacker:latest` image when the package includes an attacker service and
+  `solve.sh` (the normal GoE build/test workflow creates this image)
+
+## Deploy
+
+```bash
+uv run goe deploy docker output/<run_id>/
+```
+
+The command uses the package's `docker-compose.yml`, waits up to ten minutes for every
+system provisioning script to finish, and then leaves the containers running. Override
+the timeout or Compose project name when needed:
+
+```bash
+uv run goe deploy docker output/<run_id>/ --timeout 1200
+uv run goe deploy docker output/<run_id>/ --project-name goe-training-lab
+```
+
+Each system's declared exposed ports are published with the same host port on
+`127.0.0.1` only. Deployment will fail if one of those host ports is already occupied.
+Keep these intentionally vulnerable services loopback-only unless you have isolated the
+host network and deliberately edit the generated Compose file.
+
+The deployment record is stored at `output/<run_id>/.docker/manifest.json`. A failed
+provisioning attempt is preserved for inspection rather than silently removed.
+
+## Inspect and remove
+
+```bash
+uv run goe status output/<run_id>/ --provider docker
+uv run goe destroy output/<run_id>/ --provider docker
+```
+
+`destroy` removes the Compose project's containers, network, and named volumes. It does
+not delete the generated output package or Docker images. If an output has only one
+deployment provider, `--provider` may be omitted.

goe/deploy/__init__.py

@@ -0,0 +1 @@
+"""Deployment support for packaged GoE scenarios."""