diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..e2ca199
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,26 @@
+# Prerequisites before running:
+#
+# 1. Build the frontend:
+#    cd frontend && npm run build
+#
+# 2. Set ANTHROPIC_API_KEY in your environment:
+#    export ANTHROPIC_API_KEY=your-key-here
+#
+# 3. Generate a bcrypt password hash for AUTH_PASS_HASH:
+#    python -c "import bcrypt; print(bcrypt.hashpw(b'YOUR_PASSWORD', bcrypt.gensalt()).decode())"
+#    export AUTH_PASS_HASH='$2b$12$...'
+
+services:
+  workbench:
+    build: .
+    ports:
+      - "8080:8080"  # Web UI
+      - "6080:6080"  # noVNC browser view
+    environment:
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - AUTH_USER=${AUTH_USER:-admin@localhost}
+      - AUTH_PASS_HASH=${AUTH_PASS_HASH}
+      - DISPLAY=:99
+    volumes:
+      - ./artifacts:/app/artifacts  # persist artifacts across restarts
+    restart: unless-stopped
diff --git a/tests/test_docker_compose.sh b/tests/test_docker_compose.sh
new file mode 100755
index 0000000..c24c4fe
--- /dev/null
+++ b/tests/test_docker_compose.sh
@@ -0,0 +1,88 @@
+#!/bin/bash
+# test_docker_compose.sh - Verify docker-compose.yml matches spec for task-12
+# RED: Run before docker-compose.yml exists (should fail)
+# GREEN: Run after docker-compose.yml is created (should pass)
+
+REPO=/home/ken/workspace/research-workbench
+COMPOSE="$REPO/docker-compose.yml"
+PASS=0
+FAIL=0
+
+check_file() {
+    if [ -f "$1" ]; then
+        echo "PASS: file '$1' exists"
+        ((PASS++))
+    else
+        echo "FAIL: file '$1' should exist but is missing"
+        ((FAIL++))
+    fi
+}
+
+check_contains() {
+    local pattern="$1"
+    local label="$2"
+    if grep -qF -- "$pattern" "$COMPOSE" 2>/dev/null; then
+        echo "PASS: docker-compose.yml contains $label"
+        ((PASS++))
+    else
+        echo "FAIL: docker-compose.yml missing $label"
+        ((FAIL++))
+    fi
+}
+
+check_regex() {
+    local pattern="$1"
+    local label="$2"
+    if grep -qE "$pattern" "$COMPOSE" 2>/dev/null; then
+        echo "PASS: docker-compose.yml contains $label"
+        ((PASS++))
+    else
+        echo "FAIL: docker-compose.yml missing $label"
+        ((FAIL++))
+    fi
+}
+
+echo "=== Checking docker-compose.yml exists ==="
+check_file "$COMPOSE"
+
+echo ""
+echo "=== Checking prerequisite comments ==="
+check_contains "npm run build" "frontend build prerequisite comment"
+check_contains "ANTHROPIC_API_KEY" "ANTHROPIC_API_KEY prerequisite comment"
+check_contains "bcrypt" "bcrypt password hash prerequisite comment"
+
+echo ""
+echo "=== Checking services ==="
+check_contains "services:" "services section"
+check_contains "workbench:" "workbench service"
+
+echo ""
+echo "=== Checking build ==="
+check_regex "build: \." "build: ."
+
+echo ""
+echo "=== Checking ports ==="
+check_contains "8080:8080" "port 8080:8080 (Web UI)"
+check_contains "6080:6080" "port 6080:6080 (noVNC browser view)"
+
+echo ""
+echo "=== Checking environment variables ==="
+check_regex "ANTHROPIC_API_KEY=\\\$\{ANTHROPIC_API_KEY\}" "ANTHROPIC_API_KEY env var"
+check_regex "AUTH_USER=\\\$\{AUTH_USER:-admin@localhost\}" "AUTH_USER env var with default"
+check_regex "AUTH_PASS_HASH=\\\$\{AUTH_PASS_HASH\}" "AUTH_PASS_HASH env var"
+check_contains "DISPLAY=:99" "DISPLAY=:99 env var"
+
+echo ""
+echo "=== Checking volumes ==="
+check_contains "./artifacts:/app/artifacts" "artifacts volume"
+
+echo ""
+echo "=== Checking restart policy ==="
+check_contains "restart: unless-stopped" "restart unless-stopped"
+
+echo ""
+echo "=============================="
+echo "Results: $PASS passed, $FAIL failed"
+echo "=============================="
+
+[ $FAIL -eq 0 ] && exit 0 || exit 1