veyron2/services/mgmt/node: rename node->device, cl 2 of N (go/vissue/496)

Rename node->device throughout type/method names and comments. Virtually all
mechanical replacements, except for comment reformatting.

Renaming files and packages left for future cls.

Change-Id: I49cfd04c3ae2a7e6ffed8c76f6868d5981118fcf
diff --git a/runtimes/google/rt/mgmt.go b/runtimes/google/rt/mgmt.go
index 44e52e4..a223f02 100644
--- a/runtimes/google/rt/mgmt.go
+++ b/runtimes/google/rt/mgmt.go
@@ -17,7 +17,7 @@
 // refactor the profiles/runtime interface.
 func (rt *vrt) initMgmt(appCycle veyron2.AppCycle, handle *exec.ChildHandle) (ipc.Server, error) {
 	// Do not initialize the mgmt runtime if the process has not
-	// been started through the veyron exec library by a node
+	// been started through the veyron exec library by a device
 	// manager.
 	if handle == nil {
 		return nil, nil
diff --git a/runtimes/google/rt/security.go b/runtimes/google/rt/security.go
index e296934..80e6129 100644
--- a/runtimes/google/rt/security.go
+++ b/runtimes/google/rt/security.go
@@ -36,7 +36,7 @@
 func agentFD(handle *exec.ChildHandle) (int, error) {
 	var fd string
 	if handle != nil {
-		// We were started by a parent (presumably, node manager).
+		// We were started by a parent (presumably, device manager).
 		fd, _ = handle.Config.Get(mgmt.SecurityAgentFDConfigKey)
 	} else {
 		fd = os.Getenv(agent.FdVarName)
diff --git a/runtimes/google/rt/signal.go b/runtimes/google/rt/signal.go
index 0e5d607..aa58991 100644
--- a/runtimes/google/rt/signal.go
+++ b/runtimes/google/rt/signal.go
@@ -9,8 +9,8 @@
 )
 
 func (r *vrt) initSignalHandling() {
-	// TODO(caprita): Given that our node manager implementation is to
-	// kill all child apps when the node manager dies, we should
+	// TODO(caprita): Given that our device manager implementation is to
+	// kill all child apps when the device manager dies, we should
 	// enable SIGHUP on apps by default.
 
 	// Automatically handle SIGHUP to prevent applications started as
diff --git a/security/agent/keymgr/client.go b/security/agent/keymgr/client.go
index fa36a4c..1775a04 100644
--- a/security/agent/keymgr/client.go
+++ b/security/agent/keymgr/client.go
@@ -1,4 +1,4 @@
-// Package keymgr provides a client for the Node Manager to manage keys in
+// Package keymgr provides a client for the Device Manager to manage keys in
 // the "Agent" process.
 package keymgr
 
diff --git a/security/agent/keymgr/keymgr_test.go b/security/agent/keymgr/keymgr_test.go
index 7c89c02..33c2e74 100644
--- a/security/agent/keymgr/keymgr_test.go
+++ b/security/agent/keymgr/keymgr_test.go
@@ -39,7 +39,7 @@
 	return agent, cleanup, err
 }
 
-func TestNoNodemanager(t *testing.T) {
+func TestNoDeviceManager(t *testing.T) {
 	runtime, err := rt.New()
 	if err != nil {
 		t.Fatalf("Could not initialize runtime: %s", err)
diff --git a/security/agent/server/server.go b/security/agent/server/server.go
index 37f6970..949877f 100644
--- a/security/agent/server/server.go
+++ b/security/agent/server/server.go
@@ -69,7 +69,7 @@
 
 // RunKeyManager starts the key manager server listening on an
 // anonymous unix domain socket. It will persist principals in 'path' using 'passphrase'.
-// Typically only used by the node manager.
+// Typically only used by the device manager.
 // The returned 'client' is typically passed via cmd.ExtraFiles to a child process.
 func RunKeyManager(runtime veyron2.Runtime, path string, passphrase []byte) (client *os.File, err error) {
 	if path == "" {
diff --git a/security/agent/server/wire.vdl b/security/agent/server/wire.vdl
index 40fc724..dc52a7c 100644
--- a/security/agent/server/wire.vdl
+++ b/security/agent/server/wire.vdl
@@ -10,7 +10,7 @@
 // the recieved socket, using VCSecurityNone.
 //
 // The agent also supports an optional mode where it can manage multiple principals.
-// Typically this is only used by NodeManager. In this mode, VEYRON_AGENT_FD
+// Typically this is only used by Device Manager. In this mode, VEYRON_AGENT_FD
 // will be 3, and there will be another socket at fd 4.
 // Creating a new principal is similar to connecting to to agent: create a socket
 // pair and send one end on fd 4 with 1 byte of data.
diff --git a/services/mgmt/node/config/config.go b/services/mgmt/node/config/config.go
index 68f68e1..f9b2ea1 100644
--- a/services/mgmt/node/config/config.go
+++ b/services/mgmt/node/config/config.go
@@ -1,19 +1,20 @@
 // Package config handles configuration state passed across instances of the
-// node manager.
+// device manager.
 //
-// The State object captures setting that the node manager needs to be aware of
-// when it starts.  This is passed to the first invocation of the node manager,
-// and then passed down from old node manager to new node manager upon update.
-// The node manager has an implementation-dependent mechanism for parsing and
-// passing state, which is encapsulated by the state sub-package (currently, the
-// mechanism uses environment variables).  When instantiating a new instance of
-// the node manager service, the developer needs to pass in a copy of State.
-// They can obtain this by calling Load, which captures any config state passed
-// by a previous version of node manager during update.  Any new version of the
-// node manager must be able to decode a previous version's config state, even
-// if the new version changes the mechanism for passing this state (that is,
-// node manager implementations must be backward-compatible as far as accepting
-// and passing config state goes).  TODO(caprita): add config state versioning?
+// The State object captures setting that the device manager needs to be aware
+// of when it starts.  This is passed to the first invocation of the device
+// manager, and then passed down from old device manager to new device manager
+// upon update.  The device manager has an implementation-dependent mechanism
+// for parsing and passing state, which is encapsulated by the state sub-package
+// (currently, the mechanism uses environment variables).  When instantiating a
+// new instance of the device manager service, the developer needs to pass in a
+// copy of State.  They can obtain this by calling Load, which captures any
+// config state passed by a previous version of device manager during update.
+// Any new version of the device manager must be able to decode a previous
+// version's config state, even if the new version changes the mechanism for
+// passing this state (that is, device manager implementations must be
+// backward-compatible as far as accepting and passing config state goes).
+// TODO(caprita): add config state versioning?
 package config
 
 import (
@@ -27,28 +28,28 @@
 	"veyron.io/veyron/veyron2/services/mgmt/application"
 )
 
-// State specifies how the node manager is configured.  This should encapsulate
-// what the node manager needs to know and/or be able to mutate about its
-// environment.
+// State specifies how the device manager is configured.  This should
+// encapsulate what the device manager needs to know and/or be able to mutate
+// about its environment.
 type State struct {
-	// Name is the node manager's object name.  Must be non-empty.
+	// Name is the device manager's object name.  Must be non-empty.
 	Name string
-	// Envelope is the node manager's application envelope.  If nil, any
+	// Envelope is the device manager's application envelope.  If nil, any
 	// envelope fetched from the application repository will trigger an
 	// update.
 	Envelope *application.Envelope
-	// Previous holds the local path to the previous version of the node
+	// Previous holds the local path to the previous version of the device
 	// manager.  If empty, revert is disabled.
 	Previous string
 	// Root is the directory on the local filesystem that contains
 	// the applications' workspaces.  Must be non-empty.
 	Root string
-	// Origin is the application repository object name for the node
+	// Origin is the application repository object name for the device
 	// manager application.  If empty, update is disabled.
 	Origin string
 	// CurrentLink is the local filesystem soft link that should point to
-	// the version of the node manager binary/script through which node
-	// manager is started.  Node manager is expected to mutate this during
+	// the version of the device manager binary/script through which device
+	// manager is started.  Device manager is expected to mutate this during
 	// a self-update.  Must be non-empty.
 	CurrentLink string
 	// Helper is the path to the setuid helper for running applications as
@@ -73,8 +74,8 @@
 	return nil
 }
 
-// Load reconstructs the config state passed to the node manager (presumably by
-// the parent node manager during an update).  Currently, this is done via
+// Load reconstructs the config state passed to the device manager (presumably
+// by the parent device manager during an update).  Currently, this is done via
 // environment variables.
 func Load() (*State, error) {
 	var env *application.Envelope
@@ -94,7 +95,7 @@
 	}, nil
 }
 
-// Save serializes the config state meant to be passed to a child node manager
+// Save serializes the config state meant to be passed to a child device manager
 // during an update, returning a slice of "key=value" strings, which are
 // expected to be stuffed into environment variable settings by the caller.
 func (c *State) Save(envelope *application.Envelope) ([]string, error) {
diff --git a/services/mgmt/node/config/const.go b/services/mgmt/node/config/const.go
index 1c5aee5..17a9cc3 100644
--- a/services/mgmt/node/config/const.go
+++ b/services/mgmt/node/config/const.go
@@ -2,21 +2,21 @@
 
 const (
 	// EnvelopeEnv is the name of the environment variable that holds the
-	// serialized node manager application envelope.
+	// serialized device manager application envelope.
 	EnvelopeEnv = "VEYRON_NM_ENVELOPE"
 	// PreviousEnv is the name of the environment variable that holds the
-	// path to the previous version of the node manager.
+	// path to the previous version of the device manager.
 	PreviousEnv = "VEYRON_NM_PREVIOUS"
 	// OriginEnv is the name of the environment variable that holds the
 	// object name of the application repository that can be used to
-	// retrieve the node manager application envelope.
+	// retrieve the device manager application envelope.
 	OriginEnv = "VEYRON_NM_ORIGIN"
 	// RootEnv is the name of the environment variable that holds the
-	// path to the directory in which node manager workspaces are
+	// path to the directory in which device manager workspaces are
 	// created.
 	RootEnv = "VEYRON_NM_ROOT"
 	// CurrentLinkEnv is the name of the environment variable that holds
-	// the path to the soft link that points to the current node manager.
+	// the path to the soft link that points to the current device manager.
 	CurrentLinkEnv = "VEYRON_NM_CURRENT"
 	// HelperEnv is the name of the environment variable that holds the path
 	// to the suid helper used to start apps as specific system users.
diff --git a/services/mgmt/node/doc.go b/services/mgmt/node/doc.go
index 2f98bea..82a4271 100644
--- a/services/mgmt/node/doc.go
+++ b/services/mgmt/node/doc.go
@@ -1,34 +1,35 @@
 // Package node contains the implementation for the veyron2/mgmt/node APIs.
 //
-// The node manager is a server that is expected to run on every Veyron-enabled
-// node, and it handles both node management and management of the applications
-// running on the node.
+// The device manager is a server that is expected to run on every
+// Veyron-enabled device, and it handles both device management and management
+// of the applications running on the device.
 //
-// The node manager is responsible for installing, updating, and launching
+// The device manager is responsible for installing, updating, and launching
 // applications.  It therefore sets up a footprint on the local filesystem, both
 // to maintain its internal state, and to provide applications with their own
 // private workspaces.
 //
-// The node manager is responsible for updating itself.  The mechanism to do so
-// is implementation-dependent, though each node manager expects to be supplied
-// with the file path of a symbolic link file, which the node manager will then
-// update to point to the updated version of itself before terminating itself.
-// The node manager should therefore be launched via this symbolic link to
-// enable auto-updates.  To enable updates, in addition to the symbolic link
-// path, the node manager needs to be told what its application metadata is
-// (such as command-line arguments and environment variables, i.e. the
+// The device manager is responsible for updating itself.  The mechanism to do
+// so is implementation-dependent, though each device manager expects to be
+// supplied with the file path of a symbolic link file, which the device manager
+// will then update to point to the updated version of itself before terminating
+// itself.  The device manager should therefore be launched via this symbolic
+// link to enable auto-updates.  To enable updates, in addition to the symbolic
+// link path, the device manager needs to be told what its application metadata
+// is (such as command-line arguments and environment variables, i.e. the
 // application envelope defined in the veyron2/services/mgmt/application
 // package), as well as the object name for where it can fetch an updated
 // envelope, and the local filesystem path for its previous version (for
 // rollbacks).
 //
-// Finally, the node manager needs to know its own object name, so it can pass
+// Finally, the device manager needs to know its own object name, so it can pass
 // that along to the applications that it starts.
 //
-// The impl subpackage contains the implementation of the node manager service.
+// The impl subpackage contains the implementation of the device manager
+// service.
 //
 // The config subpackage encapsulates the configuration settings that form the
-// node manager service's 'contract' with its environment.
+// device manager service's 'contract' with its environment.
 //
 // The noded subpackage contains the main driver.
 package node
diff --git a/services/mgmt/node/impl/app_service.go b/services/mgmt/node/impl/app_service.go
index c85e75e..ca99029 100644
--- a/services/mgmt/node/impl/app_service.go
+++ b/services/mgmt/node/impl/app_service.go
@@ -1,8 +1,8 @@
 package impl
 
 // The app invoker is responsible for managing the state of applications on the
-// node manager.  The node manager manages the applications it installs and runs
-// using the following directory structure:
+// device manager.  The device manager manages the applications it installs and
+// runs using the following directory structure:
 //
 // TODO(caprita): Not all is yet implemented.
 //
@@ -55,14 +55,14 @@
 //   app-<hash 2>
 //   ...
 //
-// The node manager uses the suid helper binary to invoke an application as a
+// The device manager uses the suid helper binary to invoke an application as a
 // specified user.  The path to the helper is specified as config.Helper.
 
-// When node manager starts up, it goes through all instances and resumes the
+// When device manager starts up, it goes through all instances and resumes the
 // ones that are not suspended.  If the application was still running, it
 // suspends it first.  If an application fails to resume, it stays suspended.
 //
-// When node manager shuts down, it suspends all running instances.
+// When device manager shuts down, it suspends all running instances.
 //
 // Start starts an instance.  Suspend kills the process but leaves the workspace
 // untouched. Resume restarts the process. Stop kills the process and prevents
@@ -100,7 +100,7 @@
 // 'suspended' to 'stopped'.  If the initial state is neither 'started' or
 // 'suspended', Stop fails.
 //
-// TODO(caprita): There is room for synergy between how node manager organizes
+// TODO(caprita): There is room for synergy between how device manager organizes
 // its own workspace and that for the applications it runs.  In particular,
 // previous, origin, and envelope could be part of a single config.  We'll
 // refine that later.
@@ -151,10 +151,10 @@
 
 // instanceInfo holds state about a running instance.
 type instanceInfo struct {
-	AppCycleMgrName        string
-	Pid                    int
-	NodeManagerPeerPattern string
-	SecurityAgentHandle    []byte
+	AppCycleMgrName          string
+	Pid                      int
+	DeviceManagerPeerPattern string
+	SecurityAgentHandle      []byte
 }
 
 func saveInstanceInfo(dir string, info *instanceInfo) error {
@@ -195,7 +195,7 @@
 	startLock sync.Mutex
 }
 
-// appService implements the Node manager's Application interface.
+// appService implements the Device manager's Application interface.
 type appService struct {
 	callback *callbackState
 	config   *iconfig.State
@@ -205,8 +205,8 @@
 	suffix []string
 	uat    BlessingSystemAssociationStore
 	locks  aclLocks
-	// Reference to the nodemanager top-level ACL list.
-	nodeACL access.TaggedACLMap
+	// Reference to the devicemanager top-level ACL list.
+	deviceACL access.TaggedACLMap
 	// securityAgent holds state related to the security agent (nil if not
 	// using the agent).
 	securityAgent *securityAgentState
@@ -315,8 +315,8 @@
 	if err != nil {
 		return nil, err
 	}
-	if envelope.Title == application.NodeManagerTitle {
-		// Disallow node manager apps from being installed like a
+	if envelope.Title == application.DeviceManagerTitle {
+		// Disallow device manager apps from being installed like a
 		// regular app.
 		return nil, verror2.Make(ErrInvalidOperation, ctx)
 	}
@@ -409,9 +409,9 @@
 	}
 
 	// TODO(caprita,rjkroege): Should the installation ACLs really be
-	// seeded with the node ACL? Instead, might want to hide the nodeACL
+	// seeded with the device ACL? Instead, might want to hide the deviceACL
 	// from the app?
-	if err := initializeInstallationACLs(call.LocalPrincipal(), installationDir, call.RemoteBlessings().ForContext(call), i.nodeACL.Copy()); err != nil {
+	if err := initializeInstallationACLs(call.LocalPrincipal(), installationDir, call.RemoteBlessings().ForContext(call), i.deviceACL.Copy()); err != nil {
 		return "", err
 	}
 	deferrer = nil
@@ -523,22 +523,22 @@
 		return verror2.Make(ErrOperationFailed, nil)
 	}
 	// In addition, we give the app separate blessings for the purpose of
-	// communicating with the node manager.
+	// communicating with the device manager.
 	//
 	// NOTE(caprita/ataly): Giving the app an unconstrained blessing from
-	// the node manager's default presents the app with a blessing that's
+	// the device manager's default presents the app with a blessing that's
 	// potentially more powerful than what is strictly needed to allow
-	// communication between node manager and app (which could be more
+	// communication between device manager and app (which could be more
 	// narrowly accomplished by using a custom-purpose self-signed blessing
-	// that the node manger produces solely to talk to the app).
+	// that the device manger produces solely to talk to the app).
 	//
 	// TODO(caprita): Figure out if there is any feature value in providing
-	// the app with a node manager-derived blessing (e.g., may the app need
-	// to prove it's running on the node?).
+	// the app with a device manager-derived blessing (e.g., may the app
+	// need to prove it's running on the device?).
 	nmBlessings, err := nmPrincipal.Bless(p.PublicKey(), nmPrincipal.BlessingStore().Default(), "callback", security.UnconstrainedUse())
-	// Put the names of the node manager's default blessings as patterns for
-	// the child, so that the child uses the right blessing when talking
-	// back to the node manager.
+	// Put the names of the device manager's default blessings as patterns
+	// for the child, so that the child uses the right blessing when talking
+	// back to the device manager.
 	names := nmPrincipal.BlessingStore().Default().ForContext(call)
 	for _, n := range names {
 		if _, err := p.BlessingStore().Set(nmBlessings, security.BlessingPattern(n)); err != nil {
@@ -547,9 +547,9 @@
 		}
 	}
 	// We also want to override the app cycle manager's server blessing in
-	// the child (so that the node manager can send RPCs to it).  We signal
-	// to the child's app manager to use a randomly generated pattern to
-	// extract the right blessing to use from its store for this purpose.
+	// the child (so that the device manager can send RPCs to it).  We
+	// signal to the child's app manager to use a randomly generated pattern
+	// to extract the right blessing to use from its store for this purpose.
 	randomPattern, err := generateRandomString()
 	if err != nil {
 		vlog.Errorf("generateRandomString() failed: %v", err)
@@ -559,7 +559,7 @@
 		vlog.Errorf("BlessingStore.Set() failed: %v", err)
 		return verror2.Make(ErrOperationFailed, nil)
 	}
-	info.NodeManagerPeerPattern = randomPattern
+	info.DeviceManagerPeerPattern = randomPattern
 	if err := p.AddToRoots(nmBlessings); err != nil {
 		vlog.Errorf("AddToRoots() failed: %v", err)
 		return verror2.Make(ErrOperationFailed, nil)
@@ -652,7 +652,7 @@
 		return instanceDir, instanceID, err
 	}
 
-	if err := initializeInstanceACLs(call.LocalPrincipal(), instanceDir, call.RemoteBlessings().ForContext(call), i.nodeACL.Copy()); err != nil {
+	if err := initializeInstanceACLs(call.LocalPrincipal(), instanceDir, call.RemoteBlessings().ForContext(call), i.deviceACL.Copy()); err != nil {
 		return instanceDir, instanceID, err
 	}
 	return instanceDir, instanceID, nil
@@ -666,7 +666,7 @@
 }
 
 // systemAccountForHelper returns the uname that the helper uses to invoke the
-// application. If the helper exists and is setuid, the node manager
+// application. If the helper exists and is setuid, the device manager
 // requires that there is a uname associated with the Veyron
 // identity that requested starting an application.
 // TODO(rjkroege): This function assumes a desktop installation target
@@ -687,16 +687,17 @@
 	case haveHelper && present:
 		return systemName, nil
 	case haveHelper && !present:
-		// The helper is owned by the node manager and installed as setuid root.
-		// Therefore, the node manager must never run an app as itself to
-		// prevent an app trivially granting itself root permissions.
-		// There must be an associated uname for the account in this case.
+		// The helper is owned by the device manager and installed as
+		// setuid root.  Therefore, the device manager must never run an
+		// app as itself to prevent an app trivially granting itself
+		// root permissions.  There must be an associated uname for the
+		// account in this case.
 		return "", verror2.Make(verror2.NoAccess, ctx, "use of setuid helper requires an associated uname.")
 	case !haveHelper:
 		// When the helper is not setuid, the helper can't change the
-		// app's uid so just run the app as the node manager's uname
+		// app's uid so just run the app as the device manager's uname
 		// whether or not there is an association.
-		vlog.VI(1).Infof("helper not setuid. Node manager will invoke app with its own userid")
+		vlog.VI(1).Infof("helper not setuid. Device manager will invoke app with its own userid")
 		user, err := user.Current()
 		if err != nil {
 			vlog.Errorf("user.Current() failed: %v", err)
@@ -776,7 +777,7 @@
 	cfg.Set(mgmt.ParentNameConfigKey, listener.name())
 	cfg.Set(mgmt.ProtocolConfigKey, "tcp")
 	cfg.Set(mgmt.AddressConfigKey, "127.0.0.1:0")
-	cfg.Set(mgmt.ParentBlessingConfigKey, info.NodeManagerPeerPattern)
+	cfg.Set(mgmt.ParentBlessingConfigKey, info.DeviceManagerPeerPattern)
 
 	// Set up any agent-specific state.
 	// NOTE(caprita): This ought to belong in genCmd, but we do it here
@@ -884,8 +885,8 @@
 		return nil, err
 	}
 
-	// For now, use the namespace roots of the node manager runtime to pass
-	// to the app.
+	// For now, use the namespace roots of the device manager runtime to
+	// pass to the app.
 	if err = i.run(veyron2.RuntimeFromContext(call).Namespace().Roots(), instanceDir, systemName); err != nil {
 		// TODO(caprita): We should call cleanupDir here, but we don't
 		// in order to not lose the logs for the instance (so we can
diff --git a/services/mgmt/node/impl/association_state.go b/services/mgmt/node/impl/association_state.go
index 1e9a285..9abed47 100644
--- a/services/mgmt/node/impl/association_state.go
+++ b/services/mgmt/node/impl/association_state.go
@@ -98,9 +98,9 @@
 }
 
 func NewBlessingSystemAssociationStore(root string) (BlessingSystemAssociationStore, error) {
-	nddir := filepath.Join(root, "node-manager", "node-data")
+	nddir := filepath.Join(root, "device-manager", "device-data")
 	if err := os.MkdirAll(nddir, os.FileMode(0700)); err != nil {
-		return nil, verror2.Make(verror2.NoExist, nil, "Could not create node-data directory", nddir, err)
+		return nil, verror2.Make(verror2.NoExist, nil, "Could not create device-data directory", nddir, err)
 	}
 	msf := filepath.Join(nddir, "associated.accounts")
 
diff --git a/services/mgmt/node/impl/association_state_test.go b/services/mgmt/node/impl/association_state_test.go
index 39b8f28..2d715f1 100644
--- a/services/mgmt/node/impl/association_state_test.go
+++ b/services/mgmt/node/impl/association_state_test.go
@@ -6,6 +6,7 @@
 	"os"
 	"path"
 	"testing"
+
 	"veyron.io/veyron/veyron/services/mgmt/node/impl"
 	"veyron.io/veyron/veyron2/services/mgmt/node"
 )
@@ -138,7 +139,7 @@
 		t.Fatalf("NewBlessingSystemAssociationStore failed: %v", err)
 	}
 
-	tpath := path.Join(dir, "node-manager", "node-data", "associated.accounts")
+	tpath := path.Join(dir, "device-manager", "device-data", "associated.accounts")
 	f, err := os.Create(tpath)
 	if err != nil {
 		t.Fatalf("could not open backing file for setup: %v", err)
diff --git a/services/mgmt/node/impl/callback.go b/services/mgmt/node/impl/callback.go
index f1423b2..4c93d5c 100644
--- a/services/mgmt/node/impl/callback.go
+++ b/services/mgmt/node/impl/callback.go
@@ -9,16 +9,16 @@
 	"veyron.io/veyron/veyron/services/mgmt/node"
 )
 
-// InvokeCallback provides the parent node manager with the given name (which
-// is expected to be this node manager's object name).
+// InvokeCallback provides the parent device manager with the given name (which
+// is expected to be this device manager's object name).
 func InvokeCallback(ctx context.T, name string) {
 	handle, err := exec.GetChildHandle()
 	switch err {
 	case nil:
-		// Node manager was started by self-update, notify the parent.
+		// Device manager was started by self-update, notify the parent.
 		callbackName, err := handle.Config.Get(mgmt.ParentNameConfigKey)
 		if err != nil {
-			// Node manager was not started by self-update, return silently.
+			// Device manager was not started by self-update, return silently.
 			return
 		}
 		nmClient := node.ConfigClient(callbackName)
diff --git a/services/mgmt/node/impl/config_service.go b/services/mgmt/node/impl/config_service.go
index b7c504d..c447898 100644
--- a/services/mgmt/node/impl/config_service.go
+++ b/services/mgmt/node/impl/config_service.go
@@ -1,7 +1,7 @@
 package impl
 
 // The config invoker is responsible for answering calls to the config service
-// run as part of the node manager.  The config invoker converts RPCs to
+// run as part of the device manager.  The config invoker converts RPCs to
 // messages on channels that are used to listen on callbacks coming from child
 // application instances.
 
@@ -25,7 +25,7 @@
 	// nextCallbackID provides the next callback identifier to use as a key
 	// for the channels map.
 	nextCallbackID int64
-	// name is the object name for making calls against the node manager's
+	// name is the object name for making calls against the device manager's
 	// config service.
 	name string
 }
@@ -115,7 +115,7 @@
 	delete(c.channels, id)
 }
 
-// configService implements the Node manager's Config interface.
+// configService implements the Device manager's Config interface.
 type configService struct {
 	callback *callbackState
 	// Suffix contains an identifier for the channel corresponding to the
diff --git a/services/mgmt/node/impl/dispatcher.go b/services/mgmt/node/impl/dispatcher.go
index 5d3cb2b..db4e942 100644
--- a/services/mgmt/node/impl/dispatcher.go
+++ b/services/mgmt/node/impl/dispatcher.go
@@ -32,7 +32,7 @@
 	"veyron.io/veyron/veyron2/vlog"
 )
 
-// internalState wraps state shared between different node manager
+// internalState wraps state shared between different device manager
 // invocations.
 type internalState struct {
 	callback      *callbackState
@@ -43,18 +43,19 @@
 // aclLocks provides a mutex lock for each acl file path.
 type aclLocks map[string]*sync.Mutex
 
-// dispatcher holds the state of the node manager dispatcher.
+// dispatcher holds the state of the device manager dispatcher.
 type dispatcher struct {
 	// acl/auth hold the acl and authorizer used to authorize access to the
-	// node manager methods.
+	// device manager methods.
 	acl  access.TaggedACLMap
 	auth security.Authorizer
 	// etag holds the version string for the ACL. We use this for optimistic
-	// concurrency control when clients update the ACLs for the node manager.
+	// concurrency control when clients update the ACLs for the device
+	// manager.
 	etag string
 	// internal holds the state that persists across RPC method invocations.
 	internal *internalState
-	// config holds the node manager's (immutable) configuration state.
+	// config holds the device manager's (immutable) configuration state.
 	config *config.State
 	// dispatcherMutex is a lock for coordinating concurrent access to some
 	// dispatcher methods.
@@ -69,7 +70,7 @@
 
 const (
 	appsSuffix   = "apps"
-	nodeSuffix   = "nm"
+	deviceSuffix = "nm"
 	configSuffix = "cfg"
 
 	pkgPath = "veyron.io/veyron/veyron/services/mgmt/node/impl"
@@ -86,7 +87,7 @@
 	ErrInvalidBlessing     = verror2.Register(pkgPath+".InvalidBlessing", verror2.NoRetry, "")
 )
 
-// NewDispatcher is the node manager dispatcher factory.
+// NewDispatcher is the device manager dispatcher factory.
 func NewDispatcher(principal security.Principal, config *config.State) (*dispatcher, error) {
 	if err := config.Validate(); err != nil {
 		return nil, fmt.Errorf("invalid config %v: %v", config, err)
@@ -122,19 +123,19 @@
 		// read and verify the signature of the acl file
 		reader, err := serialization.NewVerifyingReader(data, sig, principal.PublicKey())
 		if err != nil {
-			return nil, fmt.Errorf("failed to read nodemanager ACL file:%v", err)
+			return nil, fmt.Errorf("failed to read devicemanager ACL file:%v", err)
 		}
 		acl, err := access.ReadTaggedACLMap(reader)
 		if err != nil {
-			return nil, fmt.Errorf("failed to load nodemanager ACL:%v", err)
+			return nil, fmt.Errorf("failed to load devicemanager ACL:%v", err)
 		}
 		if err := d.setACL(principal, acl, d.etag, false /* just update etag */); err != nil {
 			return nil, err
 		}
 	} else {
 		if d.auth = vflag.NewAuthorizerOrDie(); d.auth == nil {
-			// If there are no specified ACLs we grant nodemanager access to all
-			// principals until it is claimed.
+			// If there are no specified ACLs we grant devicemanager
+			// access to all principals until it is claimed.
 			d.auth = allowEveryone{}
 		}
 	}
@@ -151,13 +152,13 @@
 	return d, nil
 }
 
-func (d *dispatcher) getACLFilePaths() (acl, signature, nodedata string) {
-	nodedata = filepath.Join(d.config.Root, "node-manager", "node-data")
-	acl, signature = filepath.Join(nodedata, "acl.nodemanager"), filepath.Join(nodedata, "acl.signature")
+func (d *dispatcher) getACLFilePaths() (acl, signature, devicedata string) {
+	devicedata = filepath.Join(d.config.Root, "device-manager", "device-data")
+	acl, signature = filepath.Join(devicedata, "acl.devicemanager"), filepath.Join(devicedata, "acl.signature")
 	return
 }
 
-func (d *dispatcher) claimNodeManager(principal security.Principal, names []string, proof security.Blessings) error {
+func (d *dispatcher) claimDeviceManager(principal security.Principal, names []string, proof security.Blessings) error {
 	// TODO(gauthamt): Should we start trusting these identity providers?
 	// TODO(rjkroege): Scrub the state tree of installation and instance ACL files.
 	if len(names) == 0 {
@@ -166,7 +167,7 @@
 	}
 	principal.BlessingStore().Set(proof, security.AllPrincipals)
 	principal.BlessingStore().SetDefault(proof)
-	// Create ACLs to transfer nodemanager permissions to the provided identity.
+	// Create ACLs to transfer devicemanager permissions to the provided identity.
 	acl := make(access.TaggedACLMap)
 	for _, n := range names {
 		for _, tag := range access.AllTypicalTags() {
@@ -309,13 +310,13 @@
 func (d *dispatcher) setACL(principal security.Principal, acl access.TaggedACLMap, etag string, writeToFile bool) error {
 	d.mu.Lock()
 	defer d.mu.Unlock()
-	aclFile, sigFile, nodedata := d.getACLFilePaths()
+	aclFile, sigFile, devicedata := d.getACLFilePaths()
 
 	if len(etag) > 0 && etag != d.etag {
 		return verror.Make(access.ErrBadEtag, fmt.Sprintf("etag mismatch in:%s vers:%s", etag, d.etag))
 	}
 	if writeToFile {
-		if err := writeACLs(principal, aclFile, sigFile, nodedata, acl); err != nil {
+		if err := writeACLs(principal, aclFile, sigFile, devicedata, acl); err != nil {
 			return err
 		}
 	}
@@ -348,14 +349,14 @@
 		}
 	}
 	if len(components) == 0 {
-		return ipc.ChildrenGlobberInvoker(nodeSuffix, appsSuffix), d.auth, nil
+		return ipc.ChildrenGlobberInvoker(deviceSuffix, appsSuffix), d.auth, nil
 	}
-	// The implementation of the node manager is split up into several
+	// The implementation of the device manager is split up into several
 	// invokers, which are instantiated depending on the receiver name
 	// prefix.
 	switch components[0] {
-	case nodeSuffix:
-		receiver := node.DeviceServer(&nodeService{
+	case deviceSuffix:
+		receiver := node.DeviceServer(&deviceService{
 			callback: d.internal.callback,
 			updating: d.internal.updating,
 			config:   d.config,
@@ -402,7 +403,7 @@
 				return invoker, d.auth, nil
 			}
 		}
-		nodeACLs, _, err := d.getACL()
+		deviceACLs, _, err := d.getACL()
 		if err != nil {
 			return nil, nil, err
 		}
@@ -412,7 +413,7 @@
 			suffix:        components[1:],
 			uat:           d.uat,
 			locks:         d.locks,
-			nodeACL:       nodeACLs,
+			deviceACL:     deviceACLs,
 			securityAgent: d.internal.securityAgent,
 		})
 		appSpecificAuthorizer, err := newAppSpecificAuthorizer(d.auth, d.config, components[1:])
@@ -429,8 +430,8 @@
 			suffix:   components[1],
 		})
 		// The nil authorizer ensures that only principals blessed by
-		// the node manager can talk back to it.  All apps started by
-		// the node manager should fall in that category.
+		// the device manager can talk back to it.  All apps started by
+		// the device manager should fall in that category.
 		//
 		// TODO(caprita,rjkroege): We should further refine this, by
 		// only allowing the app to update state referring to itself
@@ -442,9 +443,11 @@
 }
 
 func newAppSpecificAuthorizer(sec security.Authorizer, config *config.State, suffix []string) (security.Authorizer, error) {
-	// TODO(rjkroege): This does not support <appname>.Start() to start all instances. Correct this.
+	// TODO(rjkroege): This does not support <appname>.Start() to start all
+	// instances. Correct this.
 
-	// If we are attempting a method invocation against "apps/", we use the node-manager wide ACL.
+	// If we are attempting a method invocation against "apps/", we use the
+	// device-manager wide ACL.
 	if len(suffix) == 0 || len(suffix) == 1 {
 		return sec, nil
 	}
diff --git a/services/mgmt/node/impl/impl_test.go b/services/mgmt/node/impl/impl_test.go
index 09e4f6d..95583c1 100644
--- a/services/mgmt/node/impl/impl_test.go
+++ b/services/mgmt/node/impl/impl_test.go
@@ -56,10 +56,10 @@
 )
 
 const (
-	execScriptCmd  = "execScriptCmd"
-	nodeManagerCmd = "nodeManager"
-	appCmd         = "app"
-	installerCmd   = "installer"
+	execScriptCmd    = "execScriptCmd"
+	deviceManagerCmd = "deviceManager"
+	appCmd           = "app"
+	installerCmd     = "installer"
 )
 
 func init() {
@@ -67,7 +67,7 @@
 	vdlutil.Register(&naming.VDLMountedServer{})
 
 	modules.RegisterChild(execScriptCmd, "", execScript)
-	modules.RegisterChild(nodeManagerCmd, "", nodeManager)
+	modules.RegisterChild(deviceManagerCmd, "", deviceManager)
 	modules.RegisterChild(appCmd, "", app)
 	modules.RegisterChild(installerCmd, "", install)
 	testutil.Init()
@@ -135,13 +135,13 @@
 	return cmd.Run()
 }
 
-// nodeManager sets up a node manager server.  It accepts the name to publish
-// the server under as an argument.  Additional arguments can optionally specify
-// node manager config settings.
-func nodeManager(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
+// deviceManager sets up a device manager server.  It accepts the name to
+// publish the server under as an argument.  Additional arguments can optionally
+// specify device manager config settings.
+func deviceManager(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	args = args[1:]
 	if len(args) == 0 {
-		vlog.Fatalf("nodeManager expected at least an argument")
+		vlog.Fatalf("deviceManager expected at least an argument")
 	}
 	publishName := args[0]
 	args = args[1:]
@@ -151,10 +151,10 @@
 	server, endpoint := newServer()
 	defer server.Stop()
 	name := naming.JoinAddressName(endpoint, "")
-	vlog.VI(1).Infof("Node manager name: %v", name)
+	vlog.VI(1).Infof("Device manager name: %v", name)
 
 	// Satisfy the contract described in doc.go by passing the config state
-	// through to the node manager dispatcher constructor.
+	// through to the device manager dispatcher constructor.
 	configState, err := config.Load()
 	if err != nil {
 		vlog.Fatalf("Failed to decode config state: %v", err)
@@ -162,8 +162,8 @@
 	configState.Name = name
 
 	// This exemplifies how to override or set specific config fields, if,
-	// for example, the node manager is invoked 'by hand' instead of via a
-	// script prepared by a previous version of the node manager.
+	// for example, the device manager is invoked 'by hand' instead of via a
+	// script prepared by a previous version of the device manager.
 	if len(args) > 0 {
 		if want, got := 4, len(args); want != got {
 			vlog.Fatalf("expected %d additional arguments, got %d instead", want, got)
@@ -172,7 +172,7 @@
 	}
 	dispatcher, err := impl.NewDispatcher(globalRT.Principal(), configState)
 	if err != nil {
-		vlog.Fatalf("Failed to create node manager dispatcher: %v", err)
+		vlog.Fatalf("Failed to create device manager dispatcher: %v", err)
 	}
 	if err := server.ServeDispatcher(publishName, dispatcher); err != nil {
 		vlog.Fatalf("Serve(%v) failed: %v", publishName, err)
@@ -187,20 +187,19 @@
 		modules.WaitForEOF(stdin)
 	}
 	if dispatcher.Leaking() {
-		vlog.Fatalf("node manager leaking resources")
+		vlog.Fatalf("device manager leaking resources")
 	}
 	return nil
 }
 
-// install installs the node manager.
+// install installs the device manager.
 func install(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	args = args[1:]
-	// args[0] is the entrypoint for the binary to be run from the shell script
-	// that SelfInstall will write out.
+	// args[0] is the entrypoint for the binary to be run from the shell
+	// script that SelfInstall will write out.
 	entrypoint := args[0]
-	// Overwrite the entrypoint in our environment (i.e. the one
-	// that got us here), with the one we want written out in the shell
-	// script.
+	// Overwrite the entrypoint in our environment (i.e. the one that got us
+	// here), with the one we want written out in the shell script.
 	osenv := modules.SetEntryPoint(env, entrypoint)
 	if args[1] != "--" {
 		vlog.Fatalf("expected '--' immediately following command name")
@@ -280,14 +279,14 @@
 	return nil
 }
 
-// TODO(rjkroege): generateNodeManagerScript and generateSuidHelperScript have code
-// similarity that might benefit from refactoring.
-// generateNodeManagerScript is very similar in behavior to generateScript in node_invoker.go.
-// However, we chose to re-implement it here for two reasons: (1) avoid making
-// generateScript public; and (2) how the test choses to invoke the node manager
-// subprocess the first time should be independent of how node manager
-// implementation sets up its updated versions.
-func generateNodeManagerScript(t *testing.T, root string, args, env []string) string {
+// TODO(rjkroege): generateDeviceManagerScript and generateSuidHelperScript have
+// code similarity that might benefit from refactoring.
+// generateDeviceManagerScript is very similar in behavior to generateScript in
+// node_invoker.go.  However, we chose to re-implement it here for two reasons:
+// (1) avoid making generateScript public; and (2) how the test choses to invoke
+// the device manager subprocess the first time should be independent of how
+// device manager implementation sets up its updated versions.
+func generateDeviceManagerScript(t *testing.T, root string, args, env []string) string {
 	env = impl.VeyronEnvironment(env)
 	output := "#!/bin/bash\n"
 	output += strings.Join(config.QuoteEnv(env), " ") + " "
@@ -296,8 +295,8 @@
 		t.Fatalf("MkdirAll failed: %v", err)
 	}
 	// Why pigeons? To show that the name we choose for the initial script
-	// doesn't matter and in particular is independent of how node manager
-	// names its updated version scripts (noded.sh).
+	// doesn't matter and in particular is independent of how device manager
+	// names its updated version scripts (deviced.sh).
 	path := filepath.Join(root, "factory", "pigeons.sh")
 	if err := ioutil.WriteFile(path, []byte(output), 0755); err != nil {
 		t.Fatalf("WriteFile(%v) failed: %v", path, err)
@@ -305,7 +304,7 @@
 	return path
 }
 
-/// readPID waits for the "ready:<PID>" line from the child and parses out the
+// readPID waits for the "ready:<PID>" line from the child and parses out the
 // PID of the child.
 func readPID(t *testing.T, s *expect.Session) int {
 	m := s.ExpectRE("ready:([0-9]+)", -1)
@@ -320,13 +319,13 @@
 	return 0
 }
 
-// TestNodeManagerUpdateAndRevert makes the node manager go through the
+// TestDeviceManagerUpdateAndRevert makes the device manager go through the
 // motions of updating itself to newer versions (twice), and reverting itself
 // back (twice). It also checks that update and revert fail when they're
-// supposed to. The initial node manager is started 'by hand' via a module
-// command. Further versions are started through the soft link that the node
+// supposed to. The initial device manager is started 'by hand' via a module
+// command. Further versions are started through the soft link that the device
 // manager itself updates.
-func TestNodeManagerUpdateAndRevert(t *testing.T) {
+func TestDeviceManagerUpdateAndRevert(t *testing.T) {
 	sh, deferFn := createShellAndMountTable(t)
 	defer deferFn()
 
@@ -341,48 +340,49 @@
 	// convenient to put it there so we have everything in one place.
 	currLink := filepath.Join(root, "current_link")
 
-	crDir, crEnv := credentialsForChild("nodemanager")
+	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
 	nmArgs := []string{"factoryNM", root, "unused_helper", mockApplicationRepoName, currLink}
-	args, env := sh.CommandEnvelope(nodeManagerCmd, crEnv, nmArgs...)
+	args, env := sh.CommandEnvelope(deviceManagerCmd, crEnv, nmArgs...)
 
-	scriptPathFactory := generateNodeManagerScript(t, root, args, env)
+	scriptPathFactory := generateDeviceManagerScript(t, root, args, env)
 
 	if err := os.Symlink(scriptPathFactory, currLink); err != nil {
 		t.Fatalf("Symlink(%q, %q) failed: %v", scriptPathFactory, currLink, err)
 	}
 
-	// We instruct the initial node manager that we run to pause before
+	// We instruct the initial device manager that we run to pause before
 	// stopping its service, so that we get a chance to verify that
 	// attempting an update while another one is ongoing will fail.
 	nmPauseBeforeStopEnv := append(crEnv, "PAUSE_BEFORE_STOP=1")
 
-	// Start the initial version of the node manager, the so-called
+	// Start the initial version of the device manager, the so-called
 	// "factory" version. We use the modules-generated command to start it.
-	// We could have also used the scriptPathFactory to start it, but
-	// this demonstrates that the initial node manager could be started by
-	// hand as long as the right initial configuration is passed into the
-	// node manager implementation.
-	nmh, nms := runShellCommand(t, sh, nmPauseBeforeStopEnv, nodeManagerCmd, nmArgs...)
+	// We could have also used the scriptPathFactory to start it, but this
+	// demonstrates that the initial device manager could be started by hand
+	// as long as the right initial configuration is passed into the device
+	// manager implementation.
+	nmh, nms := runShellCommand(t, sh, nmPauseBeforeStopEnv, deviceManagerCmd, nmArgs...)
 	defer func() {
 		syscall.Kill(nmh.Pid(), syscall.SIGINT)
 	}()
 
 	readPID(t, nms)
-	resolve(t, "factoryNM", 1) // Verify the node manager has published itself.
+	resolve(t, "factoryNM", 1) // Verify the device manager has published itself.
 
 	// Simulate an invalid envelope in the application repository.
-	*envelope = envelopeFromShell(sh, nmPauseBeforeStopEnv, nodeManagerCmd, "bogus", nmArgs...)
+	*envelope = envelopeFromShell(sh, nmPauseBeforeStopEnv, deviceManagerCmd, "bogus", nmArgs...)
 
-	updateNodeExpectError(t, "factoryNM", impl.ErrAppTitleMismatch.ID)
-	revertNodeExpectError(t, "factoryNM", impl.ErrUpdateNoOp.ID)
+	updateDeviceExpectError(t, "factoryNM", impl.ErrAppTitleMismatch.ID)
+	revertDeviceExpectError(t, "factoryNM", impl.ErrUpdateNoOp.ID)
 
-	// Set up a second version of the node manager. The information in the
-	// envelope will be used by the node manager to stage the next version.
-	crDir, crEnv = credentialsForChild("nodemanager")
+	// Set up a second version of the device manager. The information in the
+	// envelope will be used by the device manager to stage the next
+	// version.
+	crDir, crEnv = credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
-	*envelope = envelopeFromShell(sh, crEnv, nodeManagerCmd, application.NodeManagerTitle, "v2NM")
-	updateNode(t, "factoryNM")
+	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v2NM")
+	updateDevice(t, "factoryNM")
 
 	// Current link should have been updated to point to v2.
 	evalLink := func() string {
@@ -397,14 +397,14 @@
 		t.Fatalf("current link didn't change")
 	}
 
-	updateNodeExpectError(t, "factoryNM", impl.ErrOperationInProgress.ID)
+	updateDeviceExpectError(t, "factoryNM", impl.ErrOperationInProgress.ID)
 
 	nmh.CloseStdin()
 
 	nms.Expect("factoryNM terminating")
 	nmh.Shutdown(os.Stderr, os.Stderr)
 
-	// A successful update means the node manager has stopped itself.  We
+	// A successful update means the device manager has stopped itself.  We
 	// relaunch it from the current link.
 	resolveExpectNotFound(t, "v2NM") // Ensure a clean slate.
 
@@ -413,18 +413,19 @@
 	readPID(t, nms)
 	resolve(t, "v2NM", 1) // Current link should have been launching v2.
 
-	// Try issuing an update without changing the envelope in the application
-	// repository: this should fail, and current link should be unchanged.
-	updateNodeExpectError(t, "v2NM", impl.ErrUpdateNoOp.ID)
+	// Try issuing an update without changing the envelope in the
+	// application repository: this should fail, and current link should be
+	// unchanged.
+	updateDeviceExpectError(t, "v2NM", impl.ErrUpdateNoOp.ID)
 	if evalLink() != scriptPathV2 {
 		t.Fatalf("script changed")
 	}
 
-	// Create a third version of the node manager and issue an update.
-	crDir, crEnv = credentialsForChild("nodemanager")
+	// Create a third version of the device manager and issue an update.
+	crDir, crEnv = credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
-	*envelope = envelopeFromShell(sh, crEnv, nodeManagerCmd, application.NodeManagerTitle, "v3NM")
-	updateNode(t, "v2NM")
+	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v3NM")
+	updateDevice(t, "v2NM")
 
 	scriptPathV3 := evalLink()
 	if scriptPathV3 == scriptPathV2 {
@@ -437,18 +438,17 @@
 
 	resolveExpectNotFound(t, "v3NM") // Ensure a clean slate.
 
-	// Re-lanuch the node manager from current link.
-	// We instruct the node manager to pause before stopping its server, so
-	// that we can verify that a second revert fails while a revert is in
-	// progress.
+	// Re-lanuch the device manager from current link.  We instruct the
+	// device manager to pause before stopping its server, so that we can
+	// verify that a second revert fails while a revert is in progress.
 	nmh, nms = runShellCommand(t, sh, nmPauseBeforeStopEnv, execScriptCmd, currLink)
 
 	readPID(t, nms)
 	resolve(t, "v3NM", 1) // Current link should have been launching v3.
 
-	// Revert the node manager to its previous version (v2).
-	revertNode(t, "v3NM")
-	revertNodeExpectError(t, "v3NM", impl.ErrOperationInProgress.ID) // Revert already in progress.
+	// Revert the device manager to its previous version (v2).
+	revertDevice(t, "v3NM")
+	revertDeviceExpectError(t, "v3NM", impl.ErrOperationInProgress.ID) // Revert already in progress.
 	nmh.CloseStdin()
 	nms.Expect("v3NM terminating")
 	if evalLink() != scriptPathV2 {
@@ -462,8 +462,8 @@
 	readPID(t, nms)
 	resolve(t, "v2NM", 1) // Current link should have been launching v2.
 
-	// Revert the node manager to its previous version (factory).
-	revertNode(t, "v2NM")
+	// Revert the device manager to its previous version (factory).
+	revertDevice(t, "v2NM")
 	nms.Expect("v2NM terminating")
 	if evalLink() != scriptPathFactory {
 		t.Fatalf("current link was not reverted correctly")
@@ -505,11 +505,11 @@
 }
 
 func verifyAppWorkspace(t *testing.T, root, appID, instanceID string) {
-	// HACK ALERT: for now, we peek inside the node manager's directory
+	// HACK ALERT: for now, we peek inside the device manager's directory
 	// structure (which ought to be opaque) to check for what the app has
 	// written to its local root.
 	//
-	// TODO(caprita): add support to node manager to browse logs/app local
+	// TODO(caprita): add support to device manager to browse logs/app local
 	// root.
 	applicationDirName := func(title string) string {
 		h := md5.New()
@@ -566,12 +566,12 @@
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	crDir, crEnv := credentialsForChild("nodemanager")
+	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
 
-	// Set up the node manager.  Since we won't do node manager updates,
+	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	nmh, nms := runShellCommand(t, sh, crEnv, nodeManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	nmh, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	readPID(t, nms)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -720,7 +720,7 @@
 	// Starting new instances should no longer be allowed.
 	startAppExpectError(t, appID, impl.ErrInvalidOperation.ID)
 
-	// Cleanly shut down the node manager.
+	// Cleanly shut down the device manager.
 	syscall.Kill(nmh.Pid(), syscall.SIGINT)
 	nms.Expect("nm terminating")
 	nms.ExpectEOF()
@@ -780,8 +780,9 @@
 	}
 }
 
-// TestNodeManagerClaim claims a nodemanager and tests ACL permissions on its methods.
-func TestNodeManagerClaim(t *testing.T) {
+// TestDeviceManagerClaim claims a devicemanager and tests ACL permissions on
+// its methods.
+func TestDeviceManagerClaim(t *testing.T) {
 	sh, deferFn := createShellAndMountTable(t)
 	defer deferFn()
 
@@ -792,41 +793,43 @@
 	root, cleanup := setupRootDir(t)
 	defer cleanup()
 
-	crDir, crEnv := credentialsForChild("nodemanager")
+	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	// Set up the node manager.  Since we won't do node manager updates,
+	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, nodeManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := readPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	*envelope = envelopeFromShell(sh, nil, appCmd, "google naps", "trapp")
 
-	nodeStub := node.DeviceClient("nm//nm")
+	deviceStub := node.DeviceClient("nm//nm")
 	selfRT := globalRT
 	otherRT := newRuntime(t)
 	defer otherRT.Cleanup()
 
 	octx := otherRT.NewContext()
 
-	// Nodemanager should have open ACLs before we claim it and so an Install from otherRT should succeed.
+	// Devicemanager should have open ACLs before we claim it and so an
+	// Install from otherRT should succeed.
 	if err := tryInstall(octx); err != nil {
 		t.Fatalf("Failed to install: %s", err)
 	}
-	// Claim the nodemanager with selfRT as <defaultblessing>/mydevice
-	if err := nodeStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "mydevice"}); err != nil {
+	// Claim the devicemanager with selfRT as <defaultblessing>/mydevice
+	if err := deviceStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "mydevice"}); err != nil {
 		t.Fatal(err)
 	}
 
 	// Installation should succeed since globalRT (a.k.a. selfRT) is now the
-	// "owner" of the nodemanager.
+	// "owner" of the devicemanager.
 	appID := installApp(t)
 
-	// otherRT should be unable to install though, since the ACLs have changed now.
+	// otherRT should be unable to install though, since the ACLs have
+	// changed now.
 	if err := tryInstall(octx); err == nil {
 		t.Fatalf("Install should have failed from otherRT")
 	}
@@ -847,10 +850,10 @@
 	resolve(t, "trapp", 1)
 	suspendApp(t, appID, instanceID)
 
-	// TODO(gauthamt): Test that ACLs persist across nodemanager restarts
+	// TODO(gauthamt): Test that ACLs persist across devicemanager restarts
 }
 
-func TestNodeManagerUpdateACL(t *testing.T) {
+func TestDeviceManagerUpdateACL(t *testing.T) {
 	sh, deferFn := createShellAndMountTable(t)
 	defer deferFn()
 
@@ -863,16 +866,16 @@
 
 	var (
 		idp = tsecurity.NewIDProvider("root")
-		// The two "processes"/runtimes which will act as IPC clients to the
-		// nodemanager process.
+		// The two "processes"/runtimes which will act as IPC clients to
+		// the devicemanager process.
 		selfRT  = globalRT
 		otherRT = newRuntime(t)
 	)
 	defer otherRT.Cleanup()
 	octx := otherRT.NewContext()
-	// By default, selfRT and otherRT will have blessings generated based on the
-	// username/machine name running this process. Since these blessings will appear
-	// in ACLs, give them recognizable names.
+	// By default, selfRT and otherRT will have blessings generated based on
+	// the username/machine name running this process. Since these blessings
+	// will appear in ACLs, give them recognizable names.
 	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
 		t.Fatal(err)
 	}
@@ -880,20 +883,20 @@
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := credentialsForChild("nodemanager")
+	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
 
-	// Set up the node manager.  Since we won't do node manager updates,
+	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, nodeManagerCmd, "nm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
 	pid := readPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create an envelope for an app.
 	*envelope = envelopeFromShell(sh, nil, appCmd, "google naps")
 
-	nodeStub := node.DeviceClient("nm//nm")
-	acl, etag, err := nodeStub.GetACL(selfRT.NewContext())
+	deviceStub := node.DeviceClient("nm//nm")
+	acl, etag, err := deviceStub.GetACL(selfRT.NewContext())
 	if err != nil {
 		t.Fatalf("GetACL failed:%v", err)
 	}
@@ -901,8 +904,8 @@
 		t.Fatalf("getACL expected:default, got:%v(%v)", etag, acl)
 	}
 
-	// Claim the nodemanager as "root/self/mydevice"
-	if err := nodeStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "mydevice"}); err != nil {
+	// Claim the devicemanager as "root/self/mydevice"
+	if err := deviceStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "mydevice"}); err != nil {
 		t.Fatal(err)
 	}
 	expectedACL := make(access.TaggedACLMap)
@@ -915,7 +918,7 @@
 	}
 	md5hash := md5.Sum(b.Bytes())
 	expectedETAG := hex.EncodeToString(md5hash[:])
-	if acl, etag, err = nodeStub.GetACL(selfRT.NewContext()); err != nil {
+	if acl, etag, err = deviceStub.GetACL(selfRT.NewContext()); err != nil {
 		t.Fatal(err)
 	}
 	if etag != expectedETAG {
@@ -929,13 +932,14 @@
 	for _, tag := range access.AllTypicalTags() {
 		newACL.Add("root/other", string(tag))
 	}
-	if err := nodeStub.SetACL(selfRT.NewContext(), newACL, "invalid"); err == nil {
+	if err := deviceStub.SetACL(selfRT.NewContext(), newACL, "invalid"); err == nil {
 		t.Fatalf("SetACL should have failed with invalid etag")
 	}
-	if err := nodeStub.SetACL(selfRT.NewContext(), newACL, etag); err != nil {
+	if err := deviceStub.SetACL(selfRT.NewContext(), newACL, etag); err != nil {
 		t.Fatal(err)
 	}
-	// Install should now fail with selfRT, which no longer matches the ACLs but succeed with otherRT, which does.
+	// Install should now fail with selfRT, which no longer matches the ACLs
+	// but succeed with otherRT, which does.
 	if err := tryInstall(selfRT.NewContext()); err == nil {
 		t.Errorf("Install should have failed with selfRT since it should no longer match the ACL")
 	}
@@ -944,11 +948,11 @@
 	}
 }
 
-// TestNodeManagerInstall verifies the 'self install' functionality of the node
-// manager: it runs SelfInstall in a child process, then runs the executable
-// from the soft link that the installation created.  This should bring up a
-// functioning node manager.
-func TestNodeManagerInstall(t *testing.T) {
+// TestDeviceManagerInstall verifies the 'self install' functionality of the
+// device manager: it runs SelfInstall in a child process, then runs the
+// executable from the soft link that the installation created.  This should
+// bring up a functioning device manager.
+func TestDeviceManagerInstall(t *testing.T) {
 	sh, deferFn := createShellAndMountTable(t)
 	defer deferFn()
 
@@ -959,41 +963,42 @@
 	// convenient to put it there so we have everything in one place.
 	currLink := filepath.Join(root, "current_link")
 
-	// Create an 'envelope' for the node manager that we can pass to the
-	// installer, to ensure that the node manager that the installer
+	// Create an 'envelope' for the device manager that we can pass to the
+	// installer, to ensure that the device manager that the installer
 	// configures can run. The installer uses a shell script, so we need
 	// to get a set of arguments that will work from within the shell
-	// script in order for it to start a node manager.
+	// script in order for it to start a device manager.
 	// We don't need the environment here since that can only
 	// be correctly setup in the actual 'installer' command implementation
 	// (in this case the shell script) which will inherit its environment
 	// when we run it.
 	// TODO(caprita): figure out if this is really necessary, hopefully not.
-	nmargs, _ := sh.CommandEnvelope(nodeManagerCmd, nil)
-	argsForNodeManager := append([]string{nodeManagerCmd, "--"}, nmargs[1:]...)
-	argsForNodeManager = append(argsForNodeManager, "nm")
+	nmargs, _ := sh.CommandEnvelope(deviceManagerCmd, nil)
+	argsForDeviceManager := append([]string{deviceManagerCmd, "--"}, nmargs[1:]...)
+	argsForDeviceManager = append(argsForDeviceManager, "nm")
 
-	// Add vars to instruct the installer how to configure the node manager.
+	// Add vars to instruct the installer how to configure the device
+	// manager.
 	installerEnv := []string{config.RootEnv + "=" + root, config.CurrentLinkEnv + "=" + currLink, config.HelperEnv + "=" + "unused"}
-	installerh, installers := runShellCommand(t, sh, installerEnv, installerCmd, argsForNodeManager...)
+	installerh, installers := runShellCommand(t, sh, installerEnv, installerCmd, argsForDeviceManager...)
 	installers.ExpectEOF()
 	installerh.Shutdown(os.Stderr, os.Stderr)
 
-	// CurrLink should now be pointing to a node manager script that
-	// can start up a node manager.
+	// CurrLink should now be pointing to a device manager script that
+	// can start up a device manager.
 	nmh, nms := runShellCommand(t, sh, nil, execScriptCmd, currLink)
 
-	// We need the pid of the child process started by the node manager
+	// We need the pid of the child process started by the device manager
 	// script above to signal it, not the pid of the script itself.
-	// TODO(caprita): the scripts that the node manager generates
-	// should progagate signals so you don't have to obtain the pid of the
-	// child by reading it from stdout as we do here. The node manager should
-	// be able to retain a list of the processes it spawns and be confident
+	// TODO(caprita): the scripts that the device manager generates should
+	// progagate signals so you don't have to obtain the pid of the child by
+	// reading it from stdout as we do here. The device manager should be
+	// able to retain a list of the processes it spawns and be confident
 	// that sending a signal to them will also result in that signal being
 	// sent to their children and so on.
 	pid := readPID(t, nms)
 	resolve(t, "nm", 1)
-	revertNodeExpectError(t, "nm", impl.ErrUpdateNoOp.ID) // No previous version available.
+	revertDeviceExpectError(t, "nm", impl.ErrUpdateNoOp.ID) // No previous version available.
 	syscall.Kill(pid, syscall.SIGINT)
 
 	nms.Expect("nm terminating")
@@ -1001,7 +1006,7 @@
 	nmh.Shutdown(os.Stderr, os.Stderr)
 }
 
-func TestNodeManagerGlobAndDebug(t *testing.T) {
+func TestDeviceManagerGlobAndDebug(t *testing.T) {
 	sh, deferFn := createShellAndMountTable(t)
 	defer deferFn()
 
@@ -1012,15 +1017,15 @@
 	root, cleanup := setupRootDir(t)
 	defer cleanup()
 
-	crDir, crEnv := credentialsForChild("nodemanager")
+	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	// Set up the node manager.  Since we won't do node manager updates,
+	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, nodeManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := readPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
@@ -1165,7 +1170,7 @@
 	}
 }
 
-func TestNodeManagerPackages(t *testing.T) {
+func TestDeviceManagerPackages(t *testing.T) {
 	sh, deferFn := createShellAndMountTable(t)
 	defer deferFn()
 
@@ -1178,15 +1183,15 @@
 	root, cleanup := setupRootDir(t)
 	defer cleanup()
 
-	crDir, crEnv := credentialsForChild("nodemanager")
+	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	// Set up the node manager.  Since we won't do node manager updates,
+	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	_, nms := runShellCommand(t, sh, crEnv, nodeManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := readPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
@@ -1233,8 +1238,8 @@
 	compareAssociations(t, assocs, expected)
 }
 
-// TODO(rjkroege): Verify that associations persist across restarts
-// once permanent storage is added.
+// TODO(rjkroege): Verify that associations persist across restarts once
+// permanent storage is added.
 func TestAccountAssociation(t *testing.T) {
 	sh, deferFn := createShellAndMountTable(t)
 	defer deferFn()
@@ -1245,49 +1250,48 @@
 	var (
 		idp = tsecurity.NewIDProvider("root")
 		// The two "processes"/runtimes which will act as IPC clients to
-		// the nodemanager process.
+		// the devicemanager process.
 		selfRT  = globalRT
 		otherRT = newRuntime(t)
 	)
 	defer otherRT.Cleanup()
-	// By default, selfRT and otherRT will have blessings generated based
-	// on the username/machine name running this process. Since these
-	// blessings will appear in test expecations, give them readable
-	// names.
+	// By default, selfRT and otherRT will have blessings generated based on
+	// the username/machine name running this process. Since these blessings
+	// will appear in test expecations, give them readable names.
 	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
 		t.Fatal(err)
 	}
 	if err := idp.Bless(otherRT.Principal(), "other"); err != nil {
 		t.Fatal(err)
 	}
-	crFile, crEnv := credentialsForChild("nodemanager")
+	crFile, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crFile)
 
-	_, nms := runShellCommand(t, sh, crEnv, nodeManagerCmd, "nm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "nm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
 	pid := readPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
-	nodeStub := node.DeviceClient("nm//nm")
+	deviceStub := node.DeviceClient("nm//nm")
 
-	// Attempt to list associations on the node manager without having
+	// Attempt to list associations on the device manager without having
 	// claimed it.
-	if list, err := nodeStub.ListAssociations(otherRT.NewContext()); err != nil || list != nil {
-		t.Fatalf("ListAssociations should fail on unclaimed node manager but did not: %v", err)
+	if list, err := deviceStub.ListAssociations(otherRT.NewContext()); err != nil || list != nil {
+		t.Fatalf("ListAssociations should fail on unclaimed device manager but did not: %v", err)
 	}
 
-	// self claims the node manager.
-	if err := nodeStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "alice"}); err != nil {
+	// self claims the device manager.
+	if err := deviceStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "alice"}); err != nil {
 		t.Fatalf("Claim failed: %v", err)
 	}
 
 	vlog.VI(2).Info("Verify that associations start out empty.")
-	listAndVerifyAssociations(t, nodeStub, selfRT, []node.Association(nil))
+	listAndVerifyAssociations(t, deviceStub, selfRT, []node.Association(nil))
 
-	if err := nodeStub.AssociateAccount(selfRT.NewContext(), []string{"root/self", "root/other"}, "alice_system_account"); err != nil {
+	if err := deviceStub.AssociateAccount(selfRT.NewContext(), []string{"root/self", "root/other"}, "alice_system_account"); err != nil {
 		t.Fatalf("ListAssociations failed %v", err)
 	}
 	vlog.VI(2).Info("Added association should appear.")
-	listAndVerifyAssociations(t, nodeStub, selfRT, []node.Association{
+	listAndVerifyAssociations(t, deviceStub, selfRT, []node.Association{
 		{
 			"root/self",
 			"alice_system_account",
@@ -1298,11 +1302,11 @@
 		},
 	})
 
-	if err := nodeStub.AssociateAccount(selfRT.NewContext(), []string{"root/self", "root/other"}, "alice_other_account"); err != nil {
+	if err := deviceStub.AssociateAccount(selfRT.NewContext(), []string{"root/self", "root/other"}, "alice_other_account"); err != nil {
 		t.Fatalf("AssociateAccount failed %v", err)
 	}
 	vlog.VI(2).Info("Change the associations and the change should appear.")
-	listAndVerifyAssociations(t, nodeStub, selfRT, []node.Association{
+	listAndVerifyAssociations(t, deviceStub, selfRT, []node.Association{
 		{
 			"root/self",
 			"alice_other_account",
@@ -1313,11 +1317,11 @@
 		},
 	})
 
-	if err := nodeStub.AssociateAccount(selfRT.NewContext(), []string{"root/other"}, ""); err != nil {
+	if err := deviceStub.AssociateAccount(selfRT.NewContext(), []string{"root/other"}, ""); err != nil {
 		t.Fatalf("AssociateAccount failed %v", err)
 	}
 	vlog.VI(2).Info("Verify that we can remove an association.")
-	listAndVerifyAssociations(t, nodeStub, selfRT, []node.Association{
+	listAndVerifyAssociations(t, deviceStub, selfRT, []node.Association{
 		{
 			"root/self",
 			"alice_other_account",
@@ -1325,8 +1329,8 @@
 	})
 }
 
-// userName is a helper function to determine the system name that the
-// test is running under.
+// userName is a helper function to determine the system name that the test is
+// running under.
 func userName(t *testing.T) string {
 	u, err := user.Current()
 	if err != nil {
@@ -1349,16 +1353,15 @@
 	var (
 		idp = tsecurity.NewIDProvider("root")
 		// The two "processes"/runtimes which will act as IPC clients to
-		// the nodemanager process.
+		// the devicemanager process.
 		selfRT  = globalRT
 		otherRT = newRuntime(t)
 	)
 	defer otherRT.Cleanup()
 
-	// By default, selfRT and otherRT will have blessings generated
-	// based on the username/machine name running this process. Since
-	// these blessings can appear in debugging output, give them
-	// recognizable names.
+	// By default, selfRT and otherRT will have blessings generated based on
+	// the username/machine name running this process. Since these blessings
+	// can appear in debugging output, give them recognizable names.
 	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
 		t.Fatal(err)
 	}
@@ -1366,21 +1369,20 @@
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := credentialsForChild("nodemanager")
+	crDir, crEnv := credentialsForChild("devicemanager")
 	defer os.RemoveAll(crDir)
 
-	// Create a script wrapping the test target that implements
-	// suidhelper.
+	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	_, nms := runShellCommand(t, sh, crEnv, nodeManagerCmd, "-mocksetuid", "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	_, nms := runShellCommand(t, sh, crEnv, deviceManagerCmd, "-mocksetuid", "nm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
 	pid := readPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
-	nodeStub := node.DeviceClient("nm//nm")
+	deviceStub := node.DeviceClient("nm//nm")
 
-	// Create the local server that the app uses to tell us which system name
-	// the node manager wished to run it as.
+	// Create the local server that the app uses to tell us which system
+	// name the device manager wished to run it as.
 	server, _ := newServer()
 	defer server.Stop()
 	pingCh := make(chan string, 1)
@@ -1394,17 +1396,17 @@
 	// Install and start the app as root/self.
 	appID := installApp(t, selfRT)
 
-	// Claim the nodemanager with selfRT as root/self/alice
-	if err := nodeStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "alice"}); err != nil {
+	// Claim the devicemanager with selfRT as root/self/alice
+	if err := deviceStub.Claim(selfRT.NewContext(), &granter{p: selfRT.Principal(), extension: "alice"}); err != nil {
 		t.Fatal(err)
 	}
 
-	// Start an instance of the app but this time it should fail: we do
-	// not have an associated uname for the invoking identity.
+	// Start an instance of the app but this time it should fail: we do not
+	// have an associated uname for the invoking identity.
 	startAppExpectError(t, appID, verror.NoAccess, selfRT)
 
 	// Create an association for selfRT
-	if err := nodeStub.AssociateAccount(selfRT.NewContext(), []string{"root/self"}, testUserName); err != nil {
+	if err := deviceStub.AssociateAccount(selfRT.NewContext(), []string{"root/self"}, testUserName); err != nil {
 		t.Fatalf("AssociateAccount failed %v", err)
 	}
 
@@ -1416,22 +1418,23 @@
 	startAppExpectError(t, appID, verror.NoAccess, otherRT)
 
 	// Self will now let other also install apps.
-	if err := nodeStub.AssociateAccount(selfRT.NewContext(), []string{"root/other"}, testUserName); err != nil {
+	if err := deviceStub.AssociateAccount(selfRT.NewContext(), []string{"root/other"}, testUserName); err != nil {
 		t.Fatalf("AssociateAccount failed %v", err)
 	}
 	// Add Start to the ACL list for root/other.
-	newACL, _, err := nodeStub.GetACL(selfRT.NewContext())
+	newACL, _, err := deviceStub.GetACL(selfRT.NewContext())
 	if err != nil {
 		t.Fatalf("GetACL failed %v", err)
 	}
 	newACL.Add("root/other", string(access.Write))
-	if err := nodeStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
+	if err := deviceStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
 		t.Fatalf("SetACL failed %v", err)
 	}
 
-	// With the introduction of per installation and per instance ACLs, while other now
-	// has administrator permissions on the node manager, other doesn't have execution
-	// permissions for the app. So this will fail.
+	// With the introduction of per installation and per instance ACLs,
+	// while other now has administrator permissions on the device manager,
+	// other doesn't have execution permissions for the app. So this will
+	// fail.
 	vlog.VI(2).Infof("other attempting to run an app still without access. Should fail.")
 	startAppExpectError(t, appID, verror.NoAccess, otherRT)
 
@@ -1467,7 +1470,7 @@
 	stopApp(t, otherAppID, instance4ID, otherRT)
 
 	// Change the associated system name.
-	if err := nodeStub.AssociateAccount(selfRT.NewContext(), []string{"root/other"}, anotherTestUserName); err != nil {
+	if err := deviceStub.AssociateAccount(selfRT.NewContext(), []string{"root/other"}, anotherTestUserName); err != nil {
 		t.Fatalf("AssociateAccount failed %v", err)
 	}
 
diff --git a/services/mgmt/node/impl/node_installer.go b/services/mgmt/node/impl/node_installer.go
index e0deac2..c8060c9 100644
--- a/services/mgmt/node/impl/node_installer.go
+++ b/services/mgmt/node/impl/node_installer.go
@@ -15,8 +15,8 @@
 )
 
 // InstallFrom takes a veyron object name denoting an application service where
-// a node manager application envelope can be obtained.  It downloads the latest
-// version of the node manager and installs it.
+// a device manager application envelope can be obtained.  It downloads the
+// latest version of the device manager and installs it.
 func InstallFrom(origin string) error {
 	// TODO(caprita): Implement.
 	return nil
@@ -50,22 +50,22 @@
 	return filterEnvironment(env, allowedVarsRE, deniedVarsRE)
 }
 
-// SelfInstall installs the node manager and configures it using the environment
-// and the supplied command-line flags.
+// SelfInstall installs the device manager and configures it using the
+// environment and the supplied command-line flags.
 func SelfInstall(args, env []string) error {
 	configState, err := config.Load()
 	if err != nil {
 		return fmt.Errorf("failed to load config: %v", err)
 	}
 
-	vlog.VI(1).Infof("Config for node manager: %v", configState)
+	vlog.VI(1).Infof("Config for device manager: %v", configState)
 	configState.Name = "dummy" // Just so that Validate passes.
 	if err := configState.Validate(); err != nil {
 		return fmt.Errorf("invalid config %v: %v", configState, err)
 	}
 
-	// Create node manager directory tree.
-	nmDir := filepath.Join(configState.Root, "node-manager", "base")
+	// Create device manager directory tree.
+	nmDir := filepath.Join(configState.Root, "device-manager", "base")
 	if err := os.RemoveAll(nmDir); err != nil {
 		return fmt.Errorf("RemoveAll(%v) failed: %v", nmDir, err)
 	}
@@ -78,10 +78,10 @@
 		// TODO(caprita): Cleaning up env vars to avoid picking up all
 		// the garbage from the user's env.
 		// Alternatively, pass the env vars meant specifically for the
-		// node manager in a different way.
+		// device manager in a different way.
 		Env: VeyronEnvironment(env),
 	}
-	if err := linkSelf(nmDir, "noded"); err != nil {
+	if err := linkSelf(nmDir, "deviced"); err != nil {
 		return err
 	}
 	// We don't pass in the config state settings, since they're already
@@ -90,7 +90,7 @@
 		return err
 	}
 
-	// TODO(caprita): Test the node manager we just installed.
-	return updateLink(filepath.Join(nmDir, "noded.sh"), configState.CurrentLink)
+	// TODO(caprita): Test the device manager we just installed.
+	return updateLink(filepath.Join(nmDir, "deviced.sh"), configState.CurrentLink)
 	// TODO(caprita): Update system management daemon.
 }
diff --git a/services/mgmt/node/impl/node_service.go b/services/mgmt/node/impl/node_service.go
index f46b086..7c38b70 100644
--- a/services/mgmt/node/impl/node_service.go
+++ b/services/mgmt/node/impl/node_service.go
@@ -1,29 +1,29 @@
 package impl
 
-// The node invoker is responsible for managing the state of the node manager
-// itself.  The implementation expects that the node manager installations are
-// all organized in the following directory structure:
+// The device invoker is responsible for managing the state of the device
+// manager itself.  The implementation expects that the device manager
+// installations are all organized in the following directory structure:
 //
 // <config.Root>/
-//   node-manager/
+//   device-manager/
 //     <version 1 timestamp>/  - timestamp of when the version was downloaded
-//       noded                 - the node manager binary
-//       noded.sh              - a shell script to start the binary
+//       deviced               - the device manager binary
+//       deviced.sh            - a shell script to start the binary
 //     <version 2 timestamp>
 //     ...
-//     node-data/
-//       acl.nodemanager
+//     device-data/
+//       acl.devicemanager
 //	 acl.signature
 //	 associated.accounts
 //
-// The node manager is always expected to be started through the symbolic link
+// The device manager is always expected to be started through the symbolic link
 // passed in as config.CurrentLink, which is monitored by an init daemon. This
 // provides for simple and robust updates.
 //
-// To update the node manager to a newer version, a new workspace is created and
-// the symlink is updated to the new noded.sh script. Similarly, to revert the
-// node manager to a previous version, all that is required is to update the
-// symlink to point to the previous noded.sh script.
+// To update the device manager to a newer version, a new workspace is created
+// and the symlink is updated to the new deviced.sh script. Similarly, to revert
+// the device manager to a previous version, all that is required is to update
+// the symlink to point to the previous deviced.sh script.
 
 import (
 	"bufio"
@@ -57,7 +57,7 @@
 )
 
 type updatingState struct {
-	// updating is a flag that records whether this instance of node
+	// updating is a flag that records whether this instance of device
 	// manager is being updated.
 	updating bool
 	// updatingMutex is a lock for coordinating concurrent access to
@@ -85,8 +85,8 @@
 	u.updatingMutex.Unlock()
 }
 
-// nodeService implements the Node manager's Node interface.
-type nodeService struct {
+// deviceService implements the Device manager's Device interface.
+type deviceService struct {
 	updating *updatingState
 	callback *callbackState
 	config   *config.State
@@ -94,18 +94,18 @@
 	uat      BlessingSystemAssociationStore
 }
 
-func (i *nodeService) Claim(call ipc.ServerContext) error {
+func (i *deviceService) Claim(call ipc.ServerContext) error {
 	// Get the blessing to be used by the claimant.
 	blessings := call.Blessings()
 	if blessings == nil {
 		return verror2.Make(ErrInvalidBlessing, call)
 	}
-	return i.disp.claimNodeManager(call.LocalPrincipal(), blessings.ForContext(call), blessings)
+	return i.disp.claimDeviceManager(call.LocalPrincipal(), blessings.ForContext(call), blessings)
 }
 
-func (*nodeService) Describe(ipc.ServerContext) (node.Description, error) {
+func (*deviceService) Describe(ipc.ServerContext) (node.Description, error) {
 	empty := node.Description{}
-	nodeProfile, err := computeNodeProfile()
+	deviceProfile, err := computeDeviceProfile()
 	if err != nil {
 		return empty, err
 	}
@@ -113,12 +113,12 @@
 	if err != nil {
 		return empty, err
 	}
-	result := matchProfiles(nodeProfile, knownProfiles)
+	result := matchProfiles(deviceProfile, knownProfiles)
 	return result, nil
 }
 
-func (*nodeService) IsRunnable(_ ipc.ServerContext, description binary.Description) (bool, error) {
-	nodeProfile, err := computeNodeProfile()
+func (*deviceService) IsRunnable(_ ipc.ServerContext, description binary.Description) (bool, error) {
+	deviceProfile, err := computeDeviceProfile()
 	if err != nil {
 		return false, err
 	}
@@ -130,18 +130,18 @@
 		}
 		binaryProfiles = append(binaryProfiles, *profile)
 	}
-	result := matchProfiles(nodeProfile, binaryProfiles)
+	result := matchProfiles(deviceProfile, binaryProfiles)
 	return len(result.Profiles) > 0, nil
 }
 
-func (*nodeService) Reset(call ipc.ServerContext, deadline uint64) error {
+func (*deviceService) Reset(call ipc.ServerContext, deadline uint64) error {
 	// TODO(jsimsa): Implement.
 	return nil
 }
 
 // getCurrentFileInfo returns the os.FileInfo for both the symbolic link
-// CurrentLink, and the node script in the workspace that this link points to.
-func (i *nodeService) getCurrentFileInfo() (os.FileInfo, string, error) {
+// CurrentLink, and the device script in the workspace that this link points to.
+func (i *deviceService) getCurrentFileInfo() (os.FileInfo, string, error) {
 	path := i.config.CurrentLink
 	link, err := os.Lstat(path)
 	if err != nil {
@@ -156,7 +156,7 @@
 	return link, scriptPath, nil
 }
 
-func (i *nodeService) revertNodeManager(ctx context.T) error {
+func (i *deviceService) revertDeviceManager(ctx context.T) error {
 	if err := updateLink(i.config.Previous, i.config.CurrentLink); err != nil {
 		return err
 	}
@@ -165,14 +165,14 @@
 	return nil
 }
 
-func (i *nodeService) newLogfile(prefix string) (*os.File, error) {
-	d := filepath.Join(i.config.Root, "node_test_logs")
+func (i *deviceService) newLogfile(prefix string) (*os.File, error) {
+	d := filepath.Join(i.config.Root, "device_test_logs")
 	if _, err := os.Stat(d); err != nil {
 		if err := os.MkdirAll(d, 0700); err != nil {
 			return nil, err
 		}
 	}
-	f, err := ioutil.TempFile(d, "__node_impl_test__"+prefix)
+	f, err := ioutil.TempFile(d, "__device_impl_test__"+prefix)
 	if err != nil {
 		return nil, err
 	}
@@ -181,8 +181,8 @@
 
 // TODO(cnicolaou): would this be better implemented using the modules
 // framework now that it exists?
-func (i *nodeService) testNodeManager(ctx context.T, workspace string, envelope *application.Envelope) error {
-	path := filepath.Join(workspace, "noded.sh")
+func (i *deviceService) testDeviceManager(ctx context.T, workspace string, envelope *application.Envelope) error {
+	path := filepath.Join(workspace, "deviced.sh")
 	cmd := exec.Command(path)
 
 	for k, v := range map[string]*io.Writer{
@@ -191,7 +191,7 @@
 	} {
 		// Using a log file makes it less likely that stdout and stderr
 		// output will be lost if the child crashes.
-		file, err := i.newLogfile(fmt.Sprintf("noded-test-%s", k))
+		file, err := i.newLogfile(fmt.Sprintf("deviced-test-%s", k))
 		if err != nil {
 			return err
 		}
@@ -203,7 +203,7 @@
 			if f, err := os.Open(fName); err == nil {
 				scanner := bufio.NewScanner(f)
 				for scanner.Scan() {
-					vlog.Infof("[testNodeManager %s] %s", k, scanner.Text())
+					vlog.Infof("[testDeviceManager %s] %s", k, scanner.Text())
 				}
 			}
 		}()
@@ -256,19 +256,19 @@
 	if err != nil {
 		return verror2.Make(ErrOperationFailed, ctx)
 	}
-	// Check that the new node manager updated the current symbolic link.
+	// Check that the new device manager updated the current symbolic link.
 	if !linkOld.ModTime().Before(linkNew.ModTime()) {
-		vlog.Errorf("New node manager test failed")
+		vlog.Errorf("New device manager test failed")
 		return verror2.Make(ErrOperationFailed, ctx)
 	}
 	// Ensure that the current symbolic link points to the same script.
 	if pathNew != pathOld {
 		updateLink(pathOld, i.config.CurrentLink)
-		vlog.Errorf("New node manager test failed")
+		vlog.Errorf("New device manager test failed")
 		return verror2.Make(ErrOperationFailed, ctx)
 	}
 	if err := handle.Wait(childWaitTimeout); err != nil {
-		vlog.Errorf("New node manager failed to exit cleanly: %v", err)
+		vlog.Errorf("New device manager failed to exit cleanly: %v", err)
 		return verror2.Make(ErrOperationFailed, ctx)
 	}
 	return nil
@@ -292,10 +292,10 @@
 	//
 	// TODO(caprita/rthellend): expose and use shellEscape (from
 	// veyron/tools/debug/impl.go) instead.
-	output += fmt.Sprintf("exec %q", filepath.Join(workspace, "noded")) + " "
+	output += fmt.Sprintf("exec %q", filepath.Join(workspace, "deviced")) + " "
 	output += strings.Join(envelope.Args, " ")
 	output += "\n"
-	path = filepath.Join(workspace, "noded.sh")
+	path = filepath.Join(workspace, "deviced.sh")
 	if err := ioutil.WriteFile(path, []byte(output), 0700); err != nil {
 		vlog.Errorf("WriteFile(%v) failed: %v", path, err)
 		return verror2.Make(ErrOperationFailed, nil)
@@ -303,7 +303,7 @@
 	return nil
 }
 
-func (i *nodeService) updateNodeManager(ctx context.T) error {
+func (i *deviceService) updateDeviceManager(ctx context.T) error {
 	if len(i.config.Origin) == 0 {
 		return verror2.Make(ErrUpdateNoOp, ctx)
 	}
@@ -311,14 +311,14 @@
 	if err != nil {
 		return err
 	}
-	if envelope.Title != application.NodeManagerTitle {
+	if envelope.Title != application.DeviceManagerTitle {
 		return verror2.Make(ErrAppTitleMismatch, ctx)
 	}
 	if i.config.Envelope != nil && reflect.DeepEqual(envelope, i.config.Envelope) {
 		return verror2.Make(ErrUpdateNoOp, ctx)
 	}
 	// Create new workspace.
-	workspace := filepath.Join(i.config.Root, "node-manager", generateVersionDirName())
+	workspace := filepath.Join(i.config.Root, "device-manager", generateVersionDirName())
 	perm := os.FileMode(0700)
 	if err := os.MkdirAll(workspace, perm); err != nil {
 		vlog.Errorf("MkdirAll(%v, %v) failed: %v", workspace, perm, err)
@@ -334,21 +334,21 @@
 		}
 	}()
 
-	// Populate the new workspace with a node manager binary.
+	// Populate the new workspace with a device manager binary.
 	// TODO(caprita): match identical binaries on binary metadata
 	// rather than binary object name.
 	sameBinary := i.config.Envelope != nil && envelope.Binary == i.config.Envelope.Binary
 	if sameBinary {
-		if err := linkSelf(workspace, "noded"); err != nil {
+		if err := linkSelf(workspace, "deviced"); err != nil {
 			return err
 		}
 	} else {
-		if err := downloadBinary(ctx, workspace, "noded", envelope.Binary); err != nil {
+		if err := downloadBinary(ctx, workspace, "deviced", envelope.Binary); err != nil {
 			return err
 		}
 	}
 
-	// Populate the new workspace with a node manager script.
+	// Populate the new workspace with a device manager script.
 	configSettings, err := i.config.Save(envelope)
 	if err != nil {
 		return verror2.Make(ErrOperationFailed, ctx)
@@ -358,11 +358,11 @@
 		return err
 	}
 
-	if err := i.testNodeManager(ctx, workspace, envelope); err != nil {
+	if err := i.testDeviceManager(ctx, workspace, envelope); err != nil {
 		return err
 	}
 
-	if err := updateLink(filepath.Join(workspace, "noded.sh"), i.config.CurrentLink); err != nil {
+	if err := updateLink(filepath.Join(workspace, "deviced.sh"), i.config.CurrentLink); err != nil {
 		return err
 	}
 
@@ -372,25 +372,25 @@
 	return nil
 }
 
-func (*nodeService) Install(ctx ipc.ServerContext, _ string) (string, error) {
+func (*deviceService) Install(ctx ipc.ServerContext, _ string) (string, error) {
 	return "", verror2.Make(ErrInvalidSuffix, ctx)
 }
 
-func (*nodeService) Refresh(ipc.ServerContext) error {
+func (*deviceService) Refresh(ipc.ServerContext) error {
 	// TODO(jsimsa): Implement.
 	return nil
 }
 
-func (*nodeService) Restart(ipc.ServerContext) error {
+func (*deviceService) Restart(ipc.ServerContext) error {
 	// TODO(jsimsa): Implement.
 	return nil
 }
 
-func (*nodeService) Resume(ctx ipc.ServerContext) error {
+func (*deviceService) Resume(ctx ipc.ServerContext) error {
 	return verror2.Make(ErrInvalidSuffix, ctx)
 }
 
-func (i *nodeService) Revert(call ipc.ServerContext) error {
+func (i *deviceService) Revert(call ipc.ServerContext) error {
 	if i.config.Previous == "" {
 		return verror2.Make(ErrUpdateNoOp, call)
 	}
@@ -398,31 +398,31 @@
 	if updatingState.testAndSetUpdating() {
 		return verror2.Make(ErrOperationInProgress, call)
 	}
-	err := i.revertNodeManager(call)
+	err := i.revertDeviceManager(call)
 	if err != nil {
 		updatingState.unsetUpdating()
 	}
 	return err
 }
 
-func (*nodeService) Start(ctx ipc.ServerContext) ([]string, error) {
+func (*deviceService) Start(ctx ipc.ServerContext) ([]string, error) {
 	return nil, verror2.Make(ErrInvalidSuffix, ctx)
 }
 
-func (*nodeService) Stop(ctx ipc.ServerContext, _ uint32) error {
+func (*deviceService) Stop(ctx ipc.ServerContext, _ uint32) error {
 	return verror2.Make(ErrInvalidSuffix, ctx)
 }
 
-func (*nodeService) Suspend(ipc.ServerContext) error {
+func (*deviceService) Suspend(ipc.ServerContext) error {
 	// TODO(jsimsa): Implement.
 	return nil
 }
 
-func (*nodeService) Uninstall(ctx ipc.ServerContext) error {
+func (*deviceService) Uninstall(ctx ipc.ServerContext) error {
 	return verror2.Make(ErrInvalidSuffix, ctx)
 }
 
-func (i *nodeService) Update(call ipc.ServerContext) error {
+func (i *deviceService) Update(call ipc.ServerContext) error {
 	ctx, cancel := call.WithTimeout(ipcContextTimeout)
 	defer cancel()
 
@@ -431,23 +431,23 @@
 		return verror2.Make(ErrOperationInProgress, call)
 	}
 
-	err := i.updateNodeManager(ctx)
+	err := i.updateDeviceManager(ctx)
 	if err != nil {
 		updatingState.unsetUpdating()
 	}
 	return err
 }
 
-func (*nodeService) UpdateTo(ipc.ServerContext, string) error {
+func (*deviceService) UpdateTo(ipc.ServerContext, string) error {
 	// TODO(jsimsa): Implement.
 	return nil
 }
 
-func (i *nodeService) SetACL(ctx ipc.ServerContext, acl access.TaggedACLMap, etag string) error {
+func (i *deviceService) SetACL(ctx ipc.ServerContext, acl access.TaggedACLMap, etag string) error {
 	return i.disp.setACL(ctx.LocalPrincipal(), acl, etag, true /* store ACL on disk */)
 }
 
-func (i *nodeService) GetACL(_ ipc.ServerContext) (acl access.TaggedACLMap, etag string, err error) {
+func (i *deviceService) GetACL(_ ipc.ServerContext) (acl access.TaggedACLMap, etag string, err error) {
 	return i.disp.getACL()
 }
 
@@ -456,7 +456,7 @@
 	case err != nil:
 		return err
 	case local == false:
-		vlog.Errorf("SameMachine() indicates that endpoint is not on the same node")
+		vlog.Errorf("SameMachine() indicates that endpoint is not on the same device")
 		return verror2.Make(ErrOperationFailed, ctx)
 	}
 	return nil
@@ -464,7 +464,7 @@
 
 // TODO(rjkroege): Make it possible for users on the same system to also
 // associate their accounts with their identities.
-func (i *nodeService) AssociateAccount(call ipc.ServerContext, identityNames []string, accountName string) error {
+func (i *deviceService) AssociateAccount(call ipc.ServerContext, identityNames []string, accountName string) error {
 	if err := sameMachineCheck(call); err != nil {
 		return err
 	}
@@ -477,7 +477,7 @@
 	}
 }
 
-func (i *nodeService) ListAssociations(call ipc.ServerContext) (associations []node.Association, err error) {
+func (i *deviceService) ListAssociations(call ipc.ServerContext) (associations []node.Association, err error) {
 	// Temporary code. Dump this.
 	vlog.VI(2).Infof("ListAssociations given blessings: %v\n", call.RemoteBlessings().ForContext(call))
 
diff --git a/services/mgmt/node/impl/profile.go b/services/mgmt/node/impl/profile.go
index 507908d..7df74ba 100644
--- a/services/mgmt/node/impl/profile.go
+++ b/services/mgmt/node/impl/profile.go
@@ -13,13 +13,13 @@
 	"veyron.io/veyron/veyron2/services/mgmt/node"
 )
 
-// computeNodeProfile generates a description of the runtime
+// computeDeviceProfile generates a description of the runtime
 // environment (supported file format, OS, architecture, libraries) of
-// the host node.
+// the host device.
 //
-// TODO(jsimsa): Avoid computing the host node description from
+// TODO(jsimsa): Avoid computing the host device description from
 // scratch if a recent cached copy exists.
-func computeNodeProfile() (*profile.Specification, error) {
+func computeDeviceProfile() (*profile.Specification, error) {
 	result := profile.Specification{}
 
 	// Find out what the supported file format, operating system, and
@@ -163,9 +163,9 @@
 	return knownProfiles, nil
 }
 
-// matchProfiles inputs a profile that describes the host node and a
-// set of publicly known profiles and outputs a node description that
-// identifies the publicly known profiles supported by the host node.
+// matchProfiles inputs a profile that describes the host device and a
+// set of publicly known profiles and outputs a device description that
+// identifies the publicly known profiles supported by the host device.
 func matchProfiles(p *profile.Specification, known []profile.Specification) node.Description {
 	result := node.Description{Profiles: make(map[string]struct{})}
 loop:
diff --git a/services/mgmt/node/impl/util_test.go b/services/mgmt/node/impl/util_test.go
index c210818..a5f6d45 100644
--- a/services/mgmt/node/impl/util_test.go
+++ b/services/mgmt/node/impl/util_test.go
@@ -33,7 +33,7 @@
 
 const (
 	// Setting this environment variable to any non-empty value avoids
-	// removing the node manager's workspace for successful test runs (for
+	// removing the device manager's workspace for successful test runs (for
 	// failed test runs, this is already the case).  This is useful when
 	// developing test cases.
 	preserveNMWorkspaceEnv = "VEYRON_TEST_PRESERVE_NM_WORKSPACE"
@@ -134,10 +134,10 @@
 	}
 }
 
-// setupRootDir sets up and returns the local filesystem location that the node
-// manager is told to use, as well as a cleanup function.
+// setupRootDir sets up and returns the local filesystem location that the
+// device manager is told to use, as well as a cleanup function.
 func setupRootDir(t *testing.T) (string, func()) {
-	rootDir, err := ioutil.TempDir("", "nodemanager")
+	rootDir, err := ioutil.TempDir("", "devicemanager")
 	if err != nil {
 		t.Fatalf("Failed to set up temporary dir for test: %v", err)
 	}
@@ -150,7 +150,7 @@
 	}
 	return rootDir, func() {
 		if t.Failed() || os.Getenv(preserveNMWorkspaceEnv) != "" {
-			t.Logf("You can examine the node manager workspace at %v", rootDir)
+			t.Logf("You can examine the device manager workspace at %v", rootDir)
 		} else {
 			os.RemoveAll(rootDir)
 		}
@@ -201,33 +201,33 @@
 }
 
 // The following set of functions are convenience wrappers around Update and
-// Revert for node manager.
+// Revert for device manager.
 
-func nodeStub(name string) node.DeviceClientMethods {
-	nodeName := naming.Join(name, "nm")
-	return node.DeviceClient(nodeName)
+func deviceStub(name string) node.DeviceClientMethods {
+	deviceName := naming.Join(name, "nm")
+	return node.DeviceClient(deviceName)
 }
 
-func updateNodeExpectError(t *testing.T, name string, errID verror.ID) {
-	if err := nodeStub(name).Update(globalRT.NewContext()); !verror2.Is(err, errID) {
+func updateDeviceExpectError(t *testing.T, name string, errID verror.ID) {
+	if err := deviceStub(name).Update(globalRT.NewContext()); !verror2.Is(err, errID) {
 		t.Fatalf("%s: Update(%v) expected to fail with %v, got %v instead", loc(1), name, errID, err)
 	}
 }
 
-func updateNode(t *testing.T, name string) {
-	if err := nodeStub(name).Update(globalRT.NewContext()); err != nil {
+func updateDevice(t *testing.T, name string) {
+	if err := deviceStub(name).Update(globalRT.NewContext()); err != nil {
 		t.Fatalf("%s: Update(%v) failed: %v", loc(1), name, err)
 	}
 }
 
-func revertNodeExpectError(t *testing.T, name string, errID verror.ID) {
-	if err := nodeStub(name).Revert(globalRT.NewContext()); !verror2.Is(err, errID) {
+func revertDeviceExpectError(t *testing.T, name string, errID verror.ID) {
+	if err := deviceStub(name).Revert(globalRT.NewContext()); !verror2.Is(err, errID) {
 		t.Fatalf("%s: Revert(%v) expected to fail with %v, got %v instead", loc(1), name, errID, err)
 	}
 }
 
-func revertNode(t *testing.T, name string) {
-	if err := nodeStub(name).Revert(globalRT.NewContext()); err != nil {
+func revertDevice(t *testing.T, name string) {
+	if err := deviceStub(name).Revert(globalRT.NewContext()); err != nil {
 		t.Fatalf("%s: Revert(%v) failed: %v", loc(1), name, err)
 	}
 }
@@ -379,7 +379,7 @@
 	if err := os.MkdirAll(root, 0755); err != nil {
 		t.Fatalf("MkdirAll failed: %v", err)
 	}
-	// Helper does not need to live under the node manager's root dir, but
+	// Helper does not need to live under the device manager's root dir, but
 	// we put it there for convenience.
 	path := filepath.Join(root, "helper.sh")
 	if err := ioutil.WriteFile(path, []byte(output), 0755); err != nil {
diff --git a/services/mgmt/node/noded/main.go b/services/mgmt/node/noded/main.go
index afb84ff..624299c 100644
--- a/services/mgmt/node/noded/main.go
+++ b/services/mgmt/node/noded/main.go
@@ -15,7 +15,7 @@
 )
 
 var (
-	publishAs   = flag.String("name", "", "name to publish the node manager at")
+	publishAs   = flag.String("name", "", "name to publish the device manager at")
 	installSelf = flag.Bool("install_self", false, "perform installation using environment and command-line flags")
 	installFrom = flag.String("install_from", "", "if not-empty, perform installation from the provided application envelope object name")
 )
@@ -55,7 +55,7 @@
 		vlog.Fatalf("Listen(%s) failed: %v", roaming.ListenSpec, err)
 	}
 	name := naming.JoinAddressName(endpoint.String(), "")
-	vlog.VI(0).Infof("Node manager object name: %v", name)
+	vlog.VI(0).Infof("Device manager object name: %v", name)
 	configState, err := config.Load()
 	if err != nil {
 		vlog.Fatalf("Failed to load config passed from parent: %v", err)
@@ -72,7 +72,7 @@
 	if err := server.ServeDispatcher(*publishAs, dispatcher); err != nil {
 		vlog.Fatalf("Serve(%v) failed: %v", *publishAs, err)
 	}
-	vlog.VI(0).Infof("Node manager published as: %v", *publishAs)
+	vlog.VI(0).Infof("Device manager published as: %v", *publishAs)
 	impl.InvokeCallback(runtime.NewContext(), name)
 
 	// Wait until shutdown.
diff --git a/services/mgmt/profile/profile.vdl b/services/mgmt/profile/profile.vdl
index 0675af1..0337177 100644
--- a/services/mgmt/profile/profile.vdl
+++ b/services/mgmt/profile/profile.vdl
@@ -15,7 +15,7 @@
 }
 
 // Specification is how we represent a profile internally. It should
-// provide enough information to allow matching of binaries to nodes.
+// provide enough information to allow matching of binaries to devices.
 type Specification struct {
 	// Arch is the target hardware architecture of the profile.
 	Arch        build.Architecture
diff --git a/services/mgmt/profile/profile.vdl.go b/services/mgmt/profile/profile.vdl.go
index d3c766c..b67b276 100644
--- a/services/mgmt/profile/profile.vdl.go
+++ b/services/mgmt/profile/profile.vdl.go
@@ -28,7 +28,7 @@
 }
 
 // Specification is how we represent a profile internally. It should
-// provide enough information to allow matching of binaries to nodes.
+// provide enough information to allow matching of binaries to devices.
 type Specification struct {
 	// Arch is the target hardware architecture of the profile.
 	Arch build.Architecture
diff --git a/services/mgmt/suidhelper/impl/system.go b/services/mgmt/suidhelper/impl/system.go
index 2032f60..b56e5b6 100644
--- a/services/mgmt/suidhelper/impl/system.go
+++ b/services/mgmt/suidhelper/impl/system.go
@@ -25,7 +25,7 @@
 	}
 
 	for _, p := range []string{hw.workspace, hw.logDir} {
-		// TODO(rjkroege): Ensure that the nodemanager can read log entries.
+		// TODO(rjkroege): Ensure that the device manager can read log entries.
 		if err := filepath.Walk(p, chown); err != nil {
 			return fmt.Errorf("os.Chown(%s, %d, %d) failed: %v", p, hw.uid, hw.gid, err)
 		}
diff --git a/tools/mgmt/nminstall b/tools/mgmt/nminstall
index a9b6406..c366dbf 100755
--- a/tools/mgmt/nminstall
+++ b/tools/mgmt/nminstall
@@ -1,17 +1,17 @@
 #!/bin/bash
 #
-# Installs node manager on the local machine.
+# Installs device manager on the local machine.
 #
 # Specifically:
 #
-# 1. Fetches the binaries required for a node manager installation from a few
+# 1. Fetches the binaries required for a device manager installation from a few
 # possible sources.
 #
 # 2. Sets up the helper with setuid.  The helper binary needs to be owned by
-# root and have the suid bit set, to enable the node manager to run binaries
+# root and have the suid bit set, to enable the device manager to run binaries
 # under different system accounts than itself.
 #
-# 3. Runs the self-install command on the node manager.
+# 3. Runs the self-install command on the device manager.
 #
 # Usage:
 #
@@ -28,7 +28,7 @@
 
 usage() {
   echo "usage:"
-  echo "./nminstall [--single_user] <install parent dir> [<binary source>] [-- args for node manager...]"
+  echo "./nminstall [--single_user] <install parent dir> [<binary source>] [-- args for device manager...]"
 }
 
 readonly BIN_NAMES=(noded suidhelper agentd)
@@ -58,7 +58,7 @@
 }
 
 ###############################################################################
-# Fetches binaries needed by node manager installation.
+# Fetches binaries needed by device manager installation.
 # Globals:
 #   BIN_NAMES
 #   VEYRON_ROOT
@@ -139,11 +139,11 @@
     exit 1
   fi
 
-  local -r INSTALL_DIR="${INSTALL_PARENT_DIR}/node_manager"
+  local -r INSTALL_DIR="${INSTALL_PARENT_DIR}/device_manager"
 
-  # TODO(caprita): Check that the node manager is not already installed before
+  # TODO(caprita): Check that the device manager is not already installed before
   # proceeding.  We should require an explicit uninstall to avoid wiping away
-  # the node manager accidentally.
+  # the device manager accidentally.
   if [[ ${SINGLE_USER} == false ]]; then
     sudo rm -rf "${INSTALL_DIR}"
   else
@@ -179,9 +179,9 @@
   fi
   echo "Suidhelper configured."
 
-  # Tell the node manager to install itself.
+  # Tell the device manager to install itself.
   local -r NM_ROOT="${INSTALL_DIR}/nmroot"
-  echo "Installing node manager under ${NM_ROOT} ..."
+  echo "Installing device manager under ${NM_ROOT} ..."
   local -r PUBLISH=$(hostname)
   if [[ "$1" = "--" ]]; then
     shift
@@ -191,8 +191,8 @@
     exit 1
   fi
 
-  VEYRON_NM_CURRENT="${INSTALL_DIR}/noded.curr" VEYRON_NM_ROOT="${NM_ROOT}" VEYRON_NM_HELPER="${SETUID_SCRIPT}" "${BIN_INSTALL}/noded" --install_self -- --name="${PUBLISH}" "$@"
-  echo "Node manager installed."
+  VEYRON_NM_CURRENT="${INSTALL_DIR}/deviced.curr" VEYRON_NM_ROOT="${NM_ROOT}" VEYRON_NM_HELPER="${SETUID_SCRIPT}" "${BIN_INSTALL}/noded" --install_self -- --name="${PUBLISH}" "$@"
+  echo "Device manager installed."
 
   local -r SECURITY_DIR="${INSTALL_DIR}/security"
   mkdir -m 700 "${SECURITY_DIR}"
@@ -201,14 +201,14 @@
   local -r AGENT_KEY_DIR="${SECURITY_DIR}/keys"
   mkdir -m 700 "${AGENT_KEY_DIR}"
 
-  # Run node manager under the security agent.
+  # Run device manager under the security agent.
   echo
   echo "Running:"
-  echo "VEYRON_CREDENTIALS=\"${PRINCIPAL_DIR}\" \"${BIN_INSTALL}/agentd\" ${AGENT_FLAG} --additional_principals=\"${AGENT_KEY_DIR}\" \"${INSTALL_DIR}/noded.curr\""
+  echo "VEYRON_CREDENTIALS=\"${PRINCIPAL_DIR}\" \"${BIN_INSTALL}/agentd\" ${AGENT_FLAG} --additional_principals=\"${AGENT_KEY_DIR}\" \"${INSTALL_DIR}/deviced.curr\""
   echo
   # NOTE: If you update the command below, please also update the command echoed
   # above to keep the two in sync.
-  VEYRON_CREDENTIALS="${PRINCIPAL_DIR}" exec "${BIN_INSTALL}/agentd" ${AGENT_FLAG} --additional_principals="${AGENT_KEY_DIR}" "${INSTALL_DIR}/noded.curr"
+  VEYRON_CREDENTIALS="${PRINCIPAL_DIR}" exec "${BIN_INSTALL}/agentd" ${AGENT_FLAG} --additional_principals="${AGENT_KEY_DIR}" "${INSTALL_DIR}/deviced.curr"
 }
 
 main "$@"
diff --git a/tools/mgmt/nodex/acl_test.go b/tools/mgmt/nodex/acl_test.go
index 57922f8..9e6b945 100644
--- a/tools/mgmt/nodex/acl_test.go
+++ b/tools/mgmt/nodex/acl_test.go
@@ -32,7 +32,7 @@
 	cmd := root()
 	var stdout, stderr bytes.Buffer
 	cmd.Init(nil, &stdout, &stderr)
-	nodeName := naming.JoinAddressName(endpoint.String(), "")
+	deviceName := naming.JoinAddressName(endpoint.String(), "")
 
 	// Test the 'get' command.
 	tape.SetResponses([]interface{}{GetACLResponse{
@@ -49,7 +49,7 @@
 		err:  nil,
 	}})
 
-	if err := cmd.Execute([]string{"acl", "get", nodeName}); err != nil {
+	if err := cmd.Execute([]string{"acl", "get", deviceName}); err != nil {
 		t.Fatalf("%v, output: %v, error: %v", err)
 	}
 	if expected, got := strings.TrimSpace(`
@@ -78,10 +78,10 @@
 	cmd := root()
 	var stdout, stderr bytes.Buffer
 	cmd.Init(nil, &stdout, &stderr)
-	nodeName := naming.JoinAddressName(endpoint.String(), "")
+	deviceName := naming.JoinAddressName(endpoint.String(), "")
 
 	// Some tests to validate parse.
-	if err := cmd.Execute([]string{"acl", "set", nodeName}); err == nil {
+	if err := cmd.Execute([]string{"acl", "set", deviceName}); err == nil {
 		t.Fatalf("failed to correctly detect insufficient parameters")
 	}
 	if expected, got := "ERROR: set: incorrect number of arguments 1, must be 1 + 2n", strings.TrimSpace(stderr.String()); !strings.HasPrefix(got, expected) {
@@ -90,7 +90,7 @@
 
 	stderr.Reset()
 	stdout.Reset()
-	if err := cmd.Execute([]string{"acl", "set", nodeName, "foo"}); err == nil {
+	if err := cmd.Execute([]string{"acl", "set", deviceName, "foo"}); err == nil {
 		t.Fatalf("failed to correctly detect insufficient parameters")
 	}
 	if expected, got := "ERROR: set: incorrect number of arguments 2, must be 1 + 2n", strings.TrimSpace(stderr.String()); !strings.HasPrefix(got, expected) {
@@ -99,7 +99,7 @@
 
 	stderr.Reset()
 	stdout.Reset()
-	if err := cmd.Execute([]string{"acl", "set", nodeName, "foo", "bar", "ohno"}); err == nil {
+	if err := cmd.Execute([]string{"acl", "set", deviceName, "foo", "bar", "ohno"}); err == nil {
 		t.Fatalf("failed to correctly detect insufficient parameters")
 	}
 	if expected, got := "ERROR: set: incorrect number of arguments 4, must be 1 + 2n", strings.TrimSpace(stderr.String()); !strings.HasPrefix(got, expected) {
@@ -108,7 +108,7 @@
 
 	stderr.Reset()
 	stdout.Reset()
-	if err := cmd.Execute([]string{"acl", "set", nodeName, "foo", "!"}); err == nil {
+	if err := cmd.Execute([]string{"acl", "set", deviceName, "foo", "!"}); err == nil {
 		t.Fatalf("failed to detect invalid parameter")
 	}
 	if expected, got := "ERROR: failed to parse access tags for \"foo\": empty access tag", strings.TrimSpace(stderr.String()); !strings.HasPrefix(got, expected) {
@@ -156,7 +156,7 @@
 	if err := cmd.Execute([]string{
 		"acl",
 		"set",
-		nodeName,
+		deviceName,
 		"friends/...", "Admin,Write",
 		"friends/alice", "!Admin,Write",
 		"self/...", "Admin,Write,Read",
@@ -227,10 +227,10 @@
 	},
 	})
 
-	if err := cmd.Execute([]string{"acl", "set", nodeName, "vana/bad", "Read"}); err == nil {
+	if err := cmd.Execute([]string{"acl", "set", deviceName, "vana/bad", "Read"}); err == nil {
 		t.Fatalf("GetACL RPC inside acl set command failed but error wrongly not detected")
 	}
-	if expected, got := `^ERROR: GetACL\(`+nodeName+`\) failed:.*oops!`, strings.TrimSpace(stderr.String()); !regexp.MustCompile(expected).MatchString(got) {
+	if expected, got := `^ERROR: GetACL\(`+deviceName+`\) failed:.*oops!`, strings.TrimSpace(stderr.String()); !regexp.MustCompile(expected).MatchString(got) {
 		t.Fatalf("Unexpected output from list. Got %q, regexp %q", got, expected)
 	}
 	if expected, got := "", strings.TrimSpace(stdout.String()); got != expected {
@@ -260,13 +260,13 @@
 		verror.Make(errOops, nil),
 	})
 
-	if err := cmd.Execute([]string{"acl", "set", nodeName, "friend", "Read"}); err == nil {
+	if err := cmd.Execute([]string{"acl", "set", deviceName, "friend", "Read"}); err == nil {
 		t.Fatalf("SetACL should have failed: %v", err)
 	}
 	if expected, got := "", strings.TrimSpace(stdout.String()); got != expected {
 		t.Fatalf("Unexpected output from list. Got %q, expected %q", got, expected)
 	}
-	if expected, got := `^ERROR: SetACL\(`+nodeName+`\) failed:.*oops!`, strings.TrimSpace(stderr.String()); !regexp.MustCompile(expected).MatchString(got) {
+	if expected, got := `^ERROR: SetACL\(`+deviceName+`\) failed:.*oops!`, strings.TrimSpace(stderr.String()); !regexp.MustCompile(expected).MatchString(got) {
 		t.Fatalf("Unexpected output from list. Got %q, regexp %q", got, expected)
 	}
 
diff --git a/tools/mgmt/nodex/associate_impl.go b/tools/mgmt/nodex/associate_impl.go
index 479046e..06d77c3 100644
--- a/tools/mgmt/nodex/associate_impl.go
+++ b/tools/mgmt/nodex/associate_impl.go
@@ -13,9 +13,9 @@
 	Name:     "list",
 	Short:    "Lists the account associations.",
 	Long:     "Lists all account associations.",
-	ArgsName: "<nodemanager>.",
+	ArgsName: "<devicemanager>.",
 	ArgsLong: `
-<nodemanager> is the name of the node manager to connect to.`,
+<devicemanager> is the name of the device manager to connect to.`,
 }
 
 func runList(cmd *cmdline.Command, args []string) error {
@@ -41,9 +41,9 @@
 	Name:     "add",
 	Short:    "Add the listed blessings with the specified system account.",
 	Long:     "Add the listed blessings with the specified system account.",
-	ArgsName: "<nodemanager> <systemName> <blessing>...",
+	ArgsName: "<devicemanager> <systemName> <blessing>...",
 	ArgsLong: `
-<nodemanager> is the name of the node manager to connect to.
+<devicemanager> is the name of the device manager to connect to.
 <systemName> is the name of an account holder on the local system.
 <blessing>.. are the blessings to associate systemAccount with.`,
 }
@@ -62,9 +62,9 @@
 	Name:     "remove",
 	Short:    "Removes system accounts associated with the listed blessings.",
 	Long:     "Removes system accounts associated with the listed blessings.",
-	ArgsName: "<nodemanager>  <blessing>...",
+	ArgsName: "<devicemanager>  <blessing>...",
 	ArgsLong: `
-<nodemanager> is the name of the node manager to connect to.
+<devicemanager> is the name of the device manager to connect to.
 <blessing>... is a list of blessings.`,
 }
 
diff --git a/tools/mgmt/nodex/impl.go b/tools/mgmt/nodex/impl.go
index 51fb0f6..1bda19b 100644
--- a/tools/mgmt/nodex/impl.go
+++ b/tools/mgmt/nodex/impl.go
@@ -15,9 +15,9 @@
 	Name:     "install",
 	Short:    "Install the given application.",
 	Long:     "Install the given application.",
-	ArgsName: "<node> <application>",
+	ArgsName: "<device> <application>",
 	ArgsLong: `
-<node> is the veyron object name of the node manager's app service.
+<device> is the veyron object name of the device manager's app service.
 <application> is the veyron object name of the application.`,
 }
 
@@ -25,12 +25,12 @@
 	if expected, got := 2, len(args); expected != got {
 		return cmd.UsageErrorf("install: incorrect number of arguments, expected %d, got %d", expected, got)
 	}
-	nodeName, appName := args[0], args[1]
-	appID, err := node.ApplicationClient(nodeName).Install(runtime.NewContext(), appName)
+	deviceName, appName := args[0], args[1]
+	appID, err := node.ApplicationClient(deviceName).Install(runtime.NewContext(), appName)
 	if err != nil {
 		return fmt.Errorf("Install failed: %v", err)
 	}
-	fmt.Fprintf(cmd.Stdout(), "Successfully installed: %q\n", naming.Join(nodeName, appID))
+	fmt.Fprintf(cmd.Stdout(), "Successfully installed: %q\n", naming.Join(deviceName, appID))
 	return nil
 }
 
@@ -76,11 +76,11 @@
 var cmdClaim = &cmdline.Command{
 	Run:      runClaim,
 	Name:     "claim",
-	Short:    "Claim the node.",
-	Long:     "Claim the node.",
-	ArgsName: "<node> <grant extension>",
+	Short:    "Claim the device.",
+	Long:     "Claim the device.",
+	ArgsName: "<device> <grant extension>",
 	ArgsLong: `
-<node> is the veyron object name of the node manager's app service.
+<device> is the veyron object name of the device manager's app service.
 
 <grant extension> is used to extend the default blessing of the
 current principal when blessing the app instance.`,
@@ -90,8 +90,8 @@
 	if expected, got := 2, len(args); expected != got {
 		return cmd.UsageErrorf("claim: incorrect number of arguments, expected %d, got %d", expected, got)
 	}
-	nodeName, grant := args[0], args[1]
-	if err := node.DeviceClient(nodeName).Claim(runtime.NewContext(), &granter{p: runtime.Principal(), extension: grant}); err != nil {
+	deviceName, grant := args[0], args[1]
+	if err := node.DeviceClient(deviceName).Claim(runtime.NewContext(), &granter{p: runtime.Principal(), extension: grant}); err != nil {
 		return fmt.Errorf("Claim failed: %v", err)
 	}
 	fmt.Fprintln(cmd.Stdout(), "Successfully claimed.")
@@ -101,9 +101,9 @@
 func root() *cmdline.Command {
 	return &cmdline.Command{
 		Name:  "nodex",
-		Short: "Tool for interacting with the veyron node manager",
+		Short: "Tool for interacting with the veyron device manager",
 		Long: `
-The nodex tool facilitates interaction with the veyron node manager.
+The nodex tool facilitates interaction with the veyron device manager.
 `,
 		Children: []*cmdline.Command{cmdInstall, cmdStart, associateRoot(), cmdClaim, cmdStop, cmdSuspend, cmdResume, aclRoot()},
 	}
diff --git a/tools/mgmt/nodex/impl_test.go b/tools/mgmt/nodex/impl_test.go
index 535fbdb..e7239d3 100644
--- a/tools/mgmt/nodex/impl_test.go
+++ b/tools/mgmt/nodex/impl_test.go
@@ -32,7 +32,7 @@
 	cmd := root()
 	var stdout, stderr bytes.Buffer
 	cmd.Init(nil, &stdout, &stderr)
-	nodeName := naming.JoinAddressName(endpoint.String(), "")
+	deviceName := naming.JoinAddressName(endpoint.String(), "")
 
 	// Test the 'list' command.
 	tape.SetResponses([]interface{}{ListAssociationResponse{
@@ -49,7 +49,7 @@
 		err: nil,
 	}})
 
-	if err := cmd.Execute([]string{"associate", "list", nodeName}); err != nil {
+	if err := cmd.Execute([]string{"associate", "list", deviceName}); err != nil {
 		t.Fatalf("%v", err)
 	}
 	if expected, got := "root/self alice_self_account\nroot/other alice_other_account", strings.TrimSpace(stdout.String()); got != expected {
@@ -62,7 +62,7 @@
 	stdout.Reset()
 
 	// Test list with bad parameters.
-	if err := cmd.Execute([]string{"associate", "list", nodeName, "hello"}); err == nil {
+	if err := cmd.Execute([]string{"associate", "list", deviceName, "hello"}); err == nil {
 		t.Fatalf("wrongly failed to receive a non-nil error.")
 	}
 	if got, expected := len(tape.Play()), 0; got != expected {
@@ -84,7 +84,7 @@
 	cmd := root()
 	var stdout, stderr bytes.Buffer
 	cmd.Init(nil, &stdout, &stderr)
-	nodeName := naming.JoinAddressName(endpoint.String(), "/myapp/1")
+	deviceName := naming.JoinAddressName(endpoint.String(), "/myapp/1")
 
 	if err := cmd.Execute([]string{"add", "one"}); err == nil {
 		t.Fatalf("wrongly failed to receive a non-nil error.")
@@ -96,7 +96,7 @@
 	stdout.Reset()
 
 	tape.SetResponses([]interface{}{nil})
-	if err := cmd.Execute([]string{"associate", "add", nodeName, "alice", "root/self"}); err != nil {
+	if err := cmd.Execute([]string{"associate", "add", deviceName, "alice", "root/self"}); err != nil {
 		t.Fatalf("%v", err)
 	}
 	expected := []interface{}{
@@ -109,7 +109,7 @@
 	stdout.Reset()
 
 	tape.SetResponses([]interface{}{nil})
-	if err := cmd.Execute([]string{"associate", "add", nodeName, "alice", "root/other", "root/self"}); err != nil {
+	if err := cmd.Execute([]string{"associate", "add", deviceName, "alice", "root/other", "root/self"}); err != nil {
 		t.Fatalf("%v", err)
 	}
 	expected = []interface{}{
@@ -134,7 +134,7 @@
 	cmd := root()
 	var stdout, stderr bytes.Buffer
 	cmd.Init(nil, &stdout, &stderr)
-	nodeName := naming.JoinAddressName(endpoint.String(), "")
+	deviceName := naming.JoinAddressName(endpoint.String(), "")
 
 	if err := cmd.Execute([]string{"remove", "one"}); err == nil {
 		t.Fatalf("wrongly failed to receive a non-nil error.")
@@ -146,7 +146,7 @@
 	stdout.Reset()
 
 	tape.SetResponses([]interface{}{nil})
-	if err := cmd.Execute([]string{"associate", "remove", nodeName, "root/self"}); err != nil {
+	if err := cmd.Execute([]string{"associate", "remove", deviceName, "root/self"}); err != nil {
 		t.Fatalf("%v", err)
 	}
 	expected := []interface{}{
@@ -171,7 +171,7 @@
 	cmd := root()
 	var stdout, stderr bytes.Buffer
 	cmd.Init(nil, &stdout, &stderr)
-	nodeName := naming.JoinAddressName(endpoint.String(), "")
+	deviceName := naming.JoinAddressName(endpoint.String(), "")
 
 	if err := cmd.Execute([]string{"install", "blech"}); err == nil {
 		t.Fatalf("wrongly failed to receive a non-nil error.")
@@ -196,12 +196,12 @@
 		appId: appId,
 		err:   nil,
 	}})
-	if err := cmd.Execute([]string{"install", nodeName, "myBestApp"}); err != nil {
+	if err := cmd.Execute([]string{"install", deviceName, "myBestApp"}); err != nil {
 		t.Fatalf("%v", err)
 	}
 
 	eb := new(bytes.Buffer)
-	fmt.Fprintf(eb, "Successfully installed: %q", naming.Join(nodeName, appId))
+	fmt.Fprintf(eb, "Successfully installed: %q", naming.Join(deviceName, appId))
 	if expected, got := eb.String(), strings.TrimSpace(stdout.String()); got != expected {
 		t.Fatalf("Unexpected output from Install. Got %q, expected %q", got, expected)
 	}
@@ -227,7 +227,7 @@
 	cmd := root()
 	var stdout, stderr bytes.Buffer
 	cmd.Init(nil, &stdout, &stderr)
-	nodeName := naming.JoinAddressName(endpoint.String(), "")
+	deviceName := naming.JoinAddressName(endpoint.String(), "")
 
 	// Confirm that we correctly enforce the number of arguments.
 	if err := cmd.Execute([]string{"claim", "nope"}); err == nil {
@@ -254,8 +254,8 @@
 	tape.SetResponses([]interface{}{
 		nil,
 	})
-	if err := cmd.Execute([]string{"claim", nodeName, "grant"}); err != nil {
-		t.Fatalf("Claim(%s, %s) failed: %v", nodeName, "grant", err)
+	if err := cmd.Execute([]string{"claim", deviceName, "grant"}); err != nil {
+		t.Fatalf("Claim(%s, %s) failed: %v", deviceName, "grant", err)
 	}
 	if got, expected := len(tape.Play()), 1; got != expected {
 		t.Errorf("invalid call sequence. Got %v, want %v", got, expected)
@@ -277,7 +277,7 @@
 	tape.SetResponses([]interface{}{
 		verror.Make(errOops, nil),
 	})
-	if err := cmd.Execute([]string{"claim", nodeName, "grant"}); err == nil {
+	if err := cmd.Execute([]string{"claim", deviceName, "grant"}); err == nil {
 		t.Fatalf("claim() failed to detect error", err)
 	}
 	expected = []interface{}{
diff --git a/tools/mgmt/nodex/nodemanager_mock_test.go b/tools/mgmt/nodex/nodemanager_mock_test.go
index 82b1593..717122b 100644
--- a/tools/mgmt/nodex/nodemanager_mock_test.go
+++ b/tools/mgmt/nodex/nodemanager_mock_test.go
@@ -16,7 +16,7 @@
 	"veyron.io/veyron/veyron/profiles"
 )
 
-type mockNodeInvoker struct {
+type mockDeviceInvoker struct {
 	tape *Tape
 	t    *testing.T
 }
@@ -27,7 +27,7 @@
 	err error
 }
 
-func (mni *mockNodeInvoker) ListAssociations(ipc.ServerContext) (associations []node.Association, err error) {
+func (mni *mockDeviceInvoker) ListAssociations(ipc.ServerContext) (associations []node.Association, err error) {
 	vlog.VI(2).Infof("ListAssociations() was called")
 
 	ir := mni.tape.Record("ListAssociations")
@@ -44,7 +44,7 @@
 
 // simpleCore implements the core of all mock methods that take
 // arguments and return error.
-func (mni *mockNodeInvoker) simpleCore(callRecord interface{}, name string) error {
+func (mni *mockDeviceInvoker) simpleCore(callRecord interface{}, name string) error {
 	ri := mni.tape.Record(callRecord)
 	switch r := ri.(type) {
 	case nil:
@@ -56,21 +56,21 @@
 	return nil
 }
 
-func (mni *mockNodeInvoker) AssociateAccount(call ipc.ServerContext, identityNames []string, accountName string) error {
+func (mni *mockDeviceInvoker) AssociateAccount(call ipc.ServerContext, identityNames []string, accountName string) error {
 	return mni.simpleCore(AddAssociationStimulus{"AssociateAccount", identityNames, accountName}, "AssociateAccount")
 }
 
-func (mni *mockNodeInvoker) Claim(call ipc.ServerContext) error {
+func (mni *mockDeviceInvoker) Claim(call ipc.ServerContext) error {
 	return mni.simpleCore("Claim", "Claim")
 }
 
-func (*mockNodeInvoker) Describe(ipc.ServerContext) (node.Description, error) {
+func (*mockDeviceInvoker) Describe(ipc.ServerContext) (node.Description, error) {
 	return node.Description{}, nil
 }
-func (*mockNodeInvoker) IsRunnable(_ ipc.ServerContext, description binary.Description) (bool, error) {
+func (*mockDeviceInvoker) IsRunnable(_ ipc.ServerContext, description binary.Description) (bool, error) {
 	return false, nil
 }
-func (*mockNodeInvoker) Reset(call ipc.ServerContext, deadline uint64) error { return nil }
+func (*mockDeviceInvoker) Reset(call ipc.ServerContext, deadline uint64) error { return nil }
 
 // Mock Install
 type InstallStimulus struct {
@@ -83,26 +83,26 @@
 	err   error
 }
 
-func (mni *mockNodeInvoker) Install(call ipc.ServerContext, appName string) (string, error) {
+func (mni *mockDeviceInvoker) Install(call ipc.ServerContext, appName string) (string, error) {
 	ir := mni.tape.Record(InstallStimulus{"Install", appName})
 	r := ir.(InstallResponse)
 	return r.appId, r.err
 }
 
-func (*mockNodeInvoker) Refresh(ipc.ServerContext) error { return nil }
-func (*mockNodeInvoker) Restart(ipc.ServerContext) error { return nil }
+func (*mockDeviceInvoker) Refresh(ipc.ServerContext) error { return nil }
+func (*mockDeviceInvoker) Restart(ipc.ServerContext) error { return nil }
 
-func (mni *mockNodeInvoker) Resume(_ ipc.ServerContext) error {
+func (mni *mockDeviceInvoker) Resume(_ ipc.ServerContext) error {
 	return mni.simpleCore("Resume", "Resume")
 }
-func (i *mockNodeInvoker) Revert(call ipc.ServerContext) error { return nil }
+func (i *mockDeviceInvoker) Revert(call ipc.ServerContext) error { return nil }
 
 type StartResponse struct {
 	appIds []string
 	err    error
 }
 
-func (mni *mockNodeInvoker) Start(ipc.ServerContext) ([]string, error) {
+func (mni *mockDeviceInvoker) Start(ipc.ServerContext) ([]string, error) {
 	ir := mni.tape.Record("Start")
 	r := ir.(StartResponse)
 	return r.appIds, r.err
@@ -113,16 +113,16 @@
 	timeDelta uint32
 }
 
-func (mni *mockNodeInvoker) Stop(_ ipc.ServerContext, timeDelta uint32) error {
+func (mni *mockDeviceInvoker) Stop(_ ipc.ServerContext, timeDelta uint32) error {
 	return mni.simpleCore(StopStimulus{"Stop", timeDelta}, "Stop")
 }
 
-func (mni *mockNodeInvoker) Suspend(_ ipc.ServerContext) error {
+func (mni *mockDeviceInvoker) Suspend(_ ipc.ServerContext) error {
 	return mni.simpleCore("Suspend", "Suspend")
 }
-func (*mockNodeInvoker) Uninstall(ipc.ServerContext) error        { return nil }
-func (i *mockNodeInvoker) Update(ipc.ServerContext) error         { return nil }
-func (*mockNodeInvoker) UpdateTo(ipc.ServerContext, string) error { return nil }
+func (*mockDeviceInvoker) Uninstall(ipc.ServerContext) error        { return nil }
+func (i *mockDeviceInvoker) Update(ipc.ServerContext) error         { return nil }
+func (*mockDeviceInvoker) UpdateTo(ipc.ServerContext, string) error { return nil }
 
 // Mock ACL getting and setting
 type GetACLResponse struct {
@@ -137,11 +137,11 @@
 	etag string
 }
 
-func (mni *mockNodeInvoker) SetACL(_ ipc.ServerContext, acl access.TaggedACLMap, etag string) error {
+func (mni *mockDeviceInvoker) SetACL(_ ipc.ServerContext, acl access.TaggedACLMap, etag string) error {
 	return mni.simpleCore(SetACLStimulus{"SetACL", acl, etag}, "SetACL")
 }
 
-func (mni *mockNodeInvoker) GetACL(ipc.ServerContext) (access.TaggedACLMap, string, error) {
+func (mni *mockDeviceInvoker) GetACL(ipc.ServerContext) (access.TaggedACLMap, string, error) {
 	ir := mni.tape.Record("GetACL")
 	r := ir.(GetACLResponse)
 	return r.acl, r.etag, r.err
@@ -157,7 +157,7 @@
 }
 
 func (d *dispatcher) Lookup(suffix string) (interface{}, security.Authorizer, error) {
-	return node.DeviceServer(&mockNodeInvoker{tape: d.tape, t: d.t}), nil, nil
+	return node.DeviceServer(&mockDeviceInvoker{tape: d.tape, t: d.t}), nil, nil
 }
 
 func startServer(t *testing.T, r veyron2.Runtime, tape *Tape) (ipc.Server, naming.Endpoint, error) {
diff --git a/tools/mgmt/test.sh b/tools/mgmt/test.sh
index f253152..5cd276f 100755
--- a/tools/mgmt/test.sh
+++ b/tools/mgmt/test.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Test the node manager and related services and tools.
+# Test the device manager and related services and tools.
 
 source "${VEYRON_ROOT}/scripts/lib/shell_test.sh"
 
@@ -13,7 +13,7 @@
   APPLICATION_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/tools/application')"
   AGENTD_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/security/agent/agentd')"
   SUIDHELPER_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/services/mgmt/suidhelper')"
-  NODEMANAGER_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/services/mgmt/node/noded')"
+  DEVICEMANAGER_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/services/mgmt/node/noded')"
   NODEX_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/tools/mgmt/nodex')"
   NAMESPACE_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/tools/namespace')"
   PRINCIPAL_BIN="$(shell_test::build_go_binary 'veyron.io/veyron/veyron/tools/principal')"
@@ -54,7 +54,7 @@
   build
 
   BIN_STAGING_DIR=$(shell::tmp_dir)
-  cp "${AGENTD_BIN}" "${SUIDHELPER_BIN}" "${NODEMANAGER_BIN}" "${BIN_STAGING_DIR}"
+  cp "${AGENTD_BIN}" "${SUIDHELPER_BIN}" "${DEVICEMANAGER_BIN}" "${BIN_STAGING_DIR}"
   shell_test::setup_server_test
   # Unset VEYRON_CREDENTIALS set in setup_server_test.
   export VEYRON_CREDENTIALS=
@@ -62,14 +62,14 @@
   # TODO(caprita): Expose an option to turn --single_user off, so we can run
   # test.sh by hand and exercise the code that requires root privileges.
 
-  # Install and start node manager.
+  # Install and start device manager.
   shell_test::start_server "${NMINSTALL_SCRIPT}" --single_user $(shell::tmp_dir) \
-    "${BIN_STAGING_DIR}" -- --veyron.tcp.address=127.0.0.1:0 || shell_test::fail "line ${LINENO} failed to start node manager"
+    "${BIN_STAGING_DIR}" -- --veyron.tcp.address=127.0.0.1:0 || shell_test::fail "line ${LINENO} failed to start device manager"
   # Dump nminstall's log, just to provide visibility into its steps.
   cat "${START_SERVER_LOG_FILE}"
 
   local -r NM_NAME=$(hostname)
-  # Verify that node manager is published under the expected name (hostname).
+  # Verify that device manager is published under the expected name (hostname).
   shell_test::assert_ne "$("${NAMESPACE_BIN}" glob "${NM_NAME}")" "" "${LINENO}"
 
   # Create the client principal, "alice".
@@ -79,10 +79,10 @@
   # All the commands executed henceforth will run as alice.
   export VEYRON_CREDENTIALS=./alice
 
-  # Claim the node as "alice/myworkstation".
+  # Claim the device as "alice/myworkstation".
   "${NODEX_BIN}" claim "${NM_NAME}/nm" myworkstation
 
-  # Verify the node's default blessing is as expected.
+  # Verify the device's default blessing is as expected.
   shell_test::assert_eq "$("${DEBUG_BIN}" stats read "${NM_NAME}/__debug/stats/security/principal/blessingstore" | head -1 | sed -e 's/^.*Default blessings: '//)" \
     "alice/myworkstation" "${LINENO}"
 
@@ -117,10 +117,10 @@
   shell_test::assert_eq "$("${APPLICATION_BIN}" match "${SAMPLE_APP_NAME}" test | grep Title | sed -e 's/^.*"Title": "'// | sed -e 's/",//')" \
     "BINARYD" "${LINENO}"
 
-  # Install the app on the node.
+  # Install the app on the device.
   local -r INSTALLATION_NAME=$("${NODEX_BIN}" install "${NM_NAME}/apps" "${SAMPLE_APP_NAME}" | sed -e 's/Successfully installed: "//' | sed -e 's/"//')
 
-  # Verify that the installation shows up when globbing the node manager.
+  # Verify that the installation shows up when globbing the device manager.
   shell_test::assert_eq "$("${NAMESPACE_BIN}" glob "${NM_NAME}/apps/BINARYD/*")" \
     "${INSTALLATION_NAME}" "${LINENO}"
 
@@ -128,7 +128,7 @@
   local -r INSTANCE_NAME=$("${NODEX_BIN}" start "${INSTALLATION_NAME}" myapp | sed -e 's/Successfully started: "//' | sed -e 's/"//')
   wait_for_mountentry "${NAMESPACE_BIN}" "5" "${APP_PUBLISH_NAME}"
 
-  # Verify that the instance shows up when globbing the node manager.
+  # Verify that the instance shows up when globbing the device manager.
   shell_test::assert_eq "$("${NAMESPACE_BIN}" glob "${NM_NAME}/apps/BINARYD/*/*")" "${INSTANCE_NAME}" "${LINENO}"
 
   # Verify the app's default blessing.
diff --git a/tools/mgmt/vbash b/tools/mgmt/vbash
index 9a04701..a62bd1c 100755
--- a/tools/mgmt/vbash
+++ b/tools/mgmt/vbash
@@ -58,7 +58,7 @@
 }
 
 ###############################################################################
-# Fetches binaries needed by node manager installation.
+# Fetches binaries needed by device manager installation.
 # Globals:
 #   BIN_NAMES
 #   VEYRON_ROOT