Faking Slack

Mocked external services for agent-driven testing

The Problem

Agents that rebuild environments constantly can't test against real Slack

In an agent-driven software factory, agents are constantly creating new app registrations — which may exceed rate limits and require manual setup. Real accounts and OAuth make integration testing a non-starter.

The Digital Twin Universe answers with mock services.

New app registrations minted per environment
May exceed rate limits
Requires manual setup

The Mock Is Real

One 822-line mock Slack server implements exactly the surface a bot touches

Six Python modules provide 11 named Web API methods and a Socket Mode WebSocket — plus a 7-endpoint control API to simulate user messages during tests.

Small enough to trust, complete enough to fool a real bot.

822

lines of Python across 6 modules

11

named Slack Web API methods (GET + POST)

7

/mock/* control-API endpoints

The Manifest

The mock declares which real domains it owns in digital-twin-mock.yaml

It claims api.slack.com and slack.com, runs on the Docker runtime built from a Dockerfile, and listens on port 3000 as a sidecar container.

Declaring the domains is what lets interception know where to point.

# digital-twin-mock.yaml
name: slack
runtime: docker
build: Dockerfile
port: 3000
domains:
  - api.slack.com
  - slack.com

The Mechanism

mitmproxy intercepts the declared domains so code inside needs no changes

Inside the Incus environment, mitmproxy routes traffic for the declared domains to the mock sidecar — including WebSocket upgrades. It even rewrites the apps.connections.open response from ws://localhost:3000/ws to wss://api.slack.com/ws, so Socket Mode connects via TLS through the proxy.

The app runs completely unmodified — it can't tell it isn't talking to real Slack.

App calls api.slack.com as normal
mitmproxy intercepts the declared domain
Traffic routes to the mock sidecar on port 3000
WebSocket URL rewritten to wss:// through the proxy

No Credentials

The bot authenticates with fake tokens the mock never validates

The profile writes fake xapp- and xoxb- tokens the mock doesn't check, and auth.test returns ok unconditionally. Workspace state is fully in-memory and seeded to a fixed starting point on every boot.

No accounts, no OAuth, fully reproducible — torn down with the environment.

App token xapp-mock-token-for-dtu-testing
Bot token xoxb-mock-token-for-dtu-testing
Seeded state: T_MOCK001, channel C_GENERAL, one test user

The Complication

A mock is only trustworthy if it fails like the real thing

On main, an unimplemented method quietly returned {ok: true}. A silent success like that would hide integration failures — the bot would look healthy while a call it depended on was never really handled.

So the mock had a bug that could mask exactly the breakage it existed to catch.

# main (HEAD 132505e) catch-all
return {
  "ok": true,
  "warning": ...
}
# silently succeeds — hides failures

The Payoff

The factory validated itself — Amplifier found and fixed the bug

Found during real Amplifier Slack-bot validation in a Digital Twin, Amplifier changed the catch-all to fail loudly with {ok: false, error: "method_not_implemented"} and added a 7-test smoke suite. It lives on branch fix/catch-all-and-smoke-tests as open PR #1.

The mock wasn't just a shortcut — the factory used it to fix a bug in its own tooling.

# fix/catch-all-and-smoke-tests (bc477a1)
json_response({
  "ok": false,
  "error": "method_not_implemented"
})
# + test_smoke.py: 7 tests, all pass

The Pattern

Mock stateful services as sidecars; pass real read-only APIs straight through

Stateful services like Slack are mocked as sidecars with their real domains intercepted. Stateless, read-only services — LLM APIs like Anthropic — are proxied through with forwarded credentials rather than mocked.

Reproducible integration testing for agent-built software, with nothing to provision.

Mock stateful services (Slack) as Docker sidecars
Intercept their real domains with mitmproxy
Passthrough stateless APIs (Anthropic) with forwarded credentials

Sources

Research Methodology

Working / in use

Data as of: July 6, 2026 (latest commit). Independently re-verified in a fresh session.

Primary source: bkrabach/digital-twin-mock-slack (a fork of DavidKoleczek/digital-twin-mock-slack), grounded against microsoft/amplifier-bundle-digital-twin-universe.

Commands run:

find src -type f -name '*.py' | xargs wc -l → 822 total lines across 6 modules
grep -oP '"\K[a-zA-Z.]+(?=", slack_api\.)' src/mock_slack/server.py | sort -u | wc -l → 11 methods
grep -oP 'add_(get|post)\("\K/mock/[^"]+' src/mock_slack/server.py → 7 control endpoints
cat digital-twin-mock.yaml → domains api.slack.com, slack.com; port 3000
cat profiles/amplifier-hive-slack.yaml → fake xapp-/xoxb- tokens, Anthropic passthrough
cat src/mock_slack/state.py → seeded state T_MOCK001, C_GENERAL, testuser
git rev-list --all --count; git shortlog -sne --all → 4 commits (DavidKoleczek 3, Amplifier 1)
git show bc477a1; gh pr list --state all → catch-all fix + 7 smoke tests, open PR #1 (unmerged)
sed -n '1,10p' docs/mock-authoring.md (DTU) → "code running inside the environment doesn't need any changes"

Contributors: DavidKoleczek (3 commits, original author) and Amplifier / microsoft-amplifier bot (1 commit).

Gaps: The fail-loudly catch-all and 7-test smoke suite sit on an unmerged branch (open PR #1) — main's catch-all still returns ok:true. The README's endpoint list is out of date vs. code, so method names are cited from server.py. The DTU "Mock service catalog" of pre-built images is marked TBD in the DTU README (a plan, not shipped).