diff --git a/services/application/applicationd/acl_test.go b/services/application/applicationd/acl_test.go
index 86f5713..c715f85 100644
--- a/services/application/applicationd/acl_test.go
+++ b/services/application/applicationd/acl_test.go
@@ -22,7 +22,7 @@
 
 	"v.io/x/ref/lib/signals"
 	appd "v.io/x/ref/services/application/applicationd"
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/services/repository"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
@@ -48,7 +48,7 @@
 
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
 	defer vlog.VI(1).Infof("%v terminating", publishName)
-	server, endpoint := mgmttest.NewServer(ctx)
+	server, endpoint := servicetest.NewServer(ctx)
 	defer server.Stop()
 
 	name := naming.JoinAddressName(endpoint, "")
@@ -82,15 +82,15 @@
 		t.Fatal(err)
 	}
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, v23.GetPrincipal(ctx))
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, v23.GetPrincipal(ctx))
 	defer deferFn()
 
 	// setup mock up directory to put state in
-	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
+	storedir, cleanup := servicetest.SetupRootDir(t, "application")
 	defer cleanup()
 
-	nmh := mgmttest.RunCommand(t, sh, nil, repoCmd, "repo", storedir)
-	pid := mgmttest.ReadPID(t, nmh)
+	nmh := servicetest.RunCommand(t, sh, nil, repoCmd, "repo", storedir)
+	pid := servicetest.ReadPID(t, nmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	otherCtx, err := v23.SetPrincipal(ctx, testutil.NewPrincipal())
@@ -228,11 +228,11 @@
 		t.Fatal(err)
 	}
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, v23.GetPrincipal(ctx))
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, v23.GetPrincipal(ctx))
 	defer deferFn()
 
 	// setup mock up directory to put state in
-	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
+	storedir, cleanup := servicetest.SetupRootDir(t, "application")
 	defer cleanup()
 
 	otherCtx, err := v23.SetPrincipal(ctx, testutil.NewPrincipal())
@@ -243,8 +243,8 @@
 		t.Fatal(err)
 	}
 
-	nmh := mgmttest.RunCommand(t, sh, nil, repoCmd, "repo", storedir)
-	pid := mgmttest.ReadPID(t, nmh)
+	nmh := servicetest.RunCommand(t, sh, nil, repoCmd, "repo", storedir)
+	pid := servicetest.ReadPID(t, nmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create example envelope.
diff --git a/services/application/applicationd/dispatcher.go b/services/application/applicationd/dispatcher.go
index 6a9becd..9d2e65d 100644
--- a/services/application/applicationd/dispatcher.go
+++ b/services/application/applicationd/dispatcher.go
@@ -13,8 +13,8 @@
 	"v.io/v23/security/access"
 	"v.io/v23/verror"
 
-	"v.io/x/ref/services/mgmt/lib/acls"
-	"v.io/x/ref/services/mgmt/lib/fs"
+	"v.io/x/ref/services/internal/acls"
+	"v.io/x/ref/services/internal/fs"
 	"v.io/x/ref/services/repository"
 )
 
diff --git a/services/application/applicationd/impl_test.go b/services/application/applicationd/impl_test.go
index d61c7dd..781403c 100644
--- a/services/application/applicationd/impl_test.go
+++ b/services/application/applicationd/impl_test.go
@@ -18,7 +18,7 @@
 	"v.io/v23/verror"
 
 	appd "v.io/x/ref/services/application/applicationd"
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/services/repository"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
@@ -55,7 +55,7 @@
 		t.Fatalf("NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint := mgmttest.NewServer(ctx)
+	server, endpoint := servicetest.NewServer(ctx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
@@ -195,7 +195,7 @@
 		t.Fatalf("NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint := mgmttest.NewServer(ctx)
+	server, endpoint := servicetest.NewServer(ctx)
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
 		t.Fatalf("Serve(%v) failed: %v", dispatcher, err)
@@ -238,7 +238,7 @@
 		t.Fatalf("NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint = mgmttest.NewServer(ctx)
+	server, endpoint = servicetest.NewServer(ctx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
diff --git a/services/application/applicationd/service.go b/services/application/applicationd/service.go
index 07313b5..397e540 100644
--- a/services/application/applicationd/service.go
+++ b/services/application/applicationd/service.go
@@ -7,8 +7,8 @@
 import (
 	"strings"
 
-	"v.io/x/ref/services/mgmt/lib/acls"
-	"v.io/x/ref/services/mgmt/lib/fs"
+	"v.io/x/ref/services/internal/acls"
+	"v.io/x/ref/services/internal/fs"
 	"v.io/x/ref/services/repository"
 
 	"v.io/v23/context"
diff --git a/services/binary/binary/impl.go b/services/binary/binary/impl.go
index 41f6a71..6b9add4 100644
--- a/services/binary/binary/impl.go
+++ b/services/binary/binary/impl.go
@@ -9,7 +9,7 @@
 	"os"
 
 	"v.io/x/lib/cmdline"
-	"v.io/x/ref/services/mgmt/lib/binary"
+	"v.io/x/ref/services/binary/binarylib"
 )
 
 var cmdDelete = &cmdline.Command{
@@ -26,7 +26,7 @@
 		return cmd.UsageErrorf("delete: incorrect number of arguments, expected %d, got %d", expected, got)
 	}
 	von := args[0]
-	if err := binary.Delete(gctx, von); err != nil {
+	if err := binarylib.Delete(gctx, von); err != nil {
 		return err
 	}
 	fmt.Fprintf(cmd.Stdout(), "Binary deleted successfully\n")
@@ -53,7 +53,7 @@
 		return cmd.UsageErrorf("download: incorrect number of arguments, expected %d, got %d", expected, got)
 	}
 	von, filename := args[0], args[1]
-	if err := binary.DownloadToFile(gctx, von, filename); err != nil {
+	if err := binarylib.DownloadToFile(gctx, von, filename); err != nil {
 		return err
 	}
 	fmt.Fprintf(cmd.Stdout(), "Binary downloaded to file %s\n", filename)
@@ -85,14 +85,14 @@
 		return err
 	}
 	if fi.IsDir() {
-		sig, err := binary.UploadFromDir(gctx, von, filename)
+		sig, err := binarylib.UploadFromDir(gctx, von, filename)
 		if err != nil {
 			return err
 		}
 		fmt.Fprintf(cmd.Stdout(), "Binary package uploaded from directory %s signature(%v)\n", filename, sig)
 		return nil
 	}
-	sig, err := binary.UploadFromFile(gctx, von, filename)
+	sig, err := binarylib.UploadFromFile(gctx, von, filename)
 	if err != nil {
 		return err
 	}
@@ -114,7 +114,7 @@
 		return cmd.UsageErrorf("rooturl: incorrect number of arguments, expected %d, got %d", expected, got)
 	}
 	von := args[0]
-	url, _, err := binary.DownloadUrl(gctx, von)
+	url, _, err := binarylib.DownloadUrl(gctx, von)
 	if err != nil {
 		return err
 	}
diff --git a/services/binary/binarylib/acl_test.go b/services/binary/binarylib/acl_test.go
index 488b841..849540d 100644
--- a/services/binary/binarylib/acl_test.go
+++ b/services/binary/binarylib/acl_test.go
@@ -24,7 +24,7 @@
 	"v.io/x/ref/lib/signals"
 	vsecurity "v.io/x/ref/security"
 	"v.io/x/ref/services/binary/binarylib"
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
 )
@@ -48,7 +48,7 @@
 	defer vlog.VI(1).Infof("%v terminating", publishName)
 	defer shutdown()
 
-	server, endpoint := mgmttest.NewServer(ctx)
+	server, endpoint := servicetest.NewServer(ctx)
 	name := naming.JoinAddressName(endpoint, "")
 	vlog.VI(1).Infof("binaryd name: %v", name)
 
@@ -102,19 +102,19 @@
 		t.Fatalf("SetPrincipal failed: %v", err)
 	}
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, childCtx, v23.GetPrincipal(childCtx))
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, childCtx, v23.GetPrincipal(childCtx))
 	defer deferFn()
 	// make selfCtx and childCtx have the same Namespace Roots as set by
 	// CreateShellAndMountTable
 	v23.GetNamespace(selfCtx).SetRoots(v23.GetNamespace(childCtx).Roots()...)
 
 	// setup mock up directory to put state in
-	storedir, cleanup := mgmttest.SetupRootDir(t, "bindir")
+	storedir, cleanup := servicetest.SetupRootDir(t, "bindir")
 	defer cleanup()
 	prepDirectory(t, storedir)
 
-	nmh := mgmttest.RunCommand(t, sh, nil, binaryCmd, "bini", storedir)
-	pid := mgmttest.ReadPID(t, nmh)
+	nmh := servicetest.RunCommand(t, sh, nil, binaryCmd, "bini", storedir)
+	pid := servicetest.ReadPID(t, nmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	vlog.VI(2).Infof("Self uploads a shared and private binary.")
@@ -153,11 +153,11 @@
 	if err != nil {
 		t.Fatalf("SetPrincipal failed: %v", err)
 	}
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, selfCtx, v23.GetPrincipal(selfCtx))
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, selfCtx, v23.GetPrincipal(selfCtx))
 	defer deferFn()
 
 	// setup mock up directory to put state in
-	storedir, cleanup := mgmttest.SetupRootDir(t, "bindir")
+	storedir, cleanup := servicetest.SetupRootDir(t, "bindir")
 	defer cleanup()
 	prepDirectory(t, storedir)
 
@@ -170,8 +170,8 @@
 		t.Fatalf("SetPrincipal() failed: %v", err)
 	}
 
-	nmh := mgmttest.RunCommand(t, sh, nil, binaryCmd, "bini", storedir)
-	pid := mgmttest.ReadPID(t, nmh)
+	nmh := servicetest.RunCommand(t, sh, nil, binaryCmd, "bini", storedir)
+	pid := servicetest.ReadPID(t, nmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	vlog.VI(2).Infof("Self uploads a shared and private binary.")
@@ -437,11 +437,11 @@
 	if err != nil {
 		t.Fatalf("SetPrincipal failed: %v", err)
 	}
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, selfCtx, v23.GetPrincipal(selfCtx))
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, selfCtx, v23.GetPrincipal(selfCtx))
 	defer deferFn()
 
 	// setup mock up directory to put state in
-	storedir, cleanup := mgmttest.SetupRootDir(t, "bindir")
+	storedir, cleanup := servicetest.SetupRootDir(t, "bindir")
 	defer cleanup()
 	prepDirectory(t, storedir)
 
@@ -450,8 +450,8 @@
 		t.Fatalf("otherPrincipal.AddToRoots() failed: %v", err)
 	}
 
-	nmh := mgmttest.RunCommand(t, sh, nil, binaryCmd, "bini", storedir)
-	pid := mgmttest.ReadPID(t, nmh)
+	nmh := servicetest.RunCommand(t, sh, nil, binaryCmd, "bini", storedir)
+	pid := servicetest.ReadPID(t, nmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	acl, tag, err := b("bini").GetPermissions(selfCtx)
diff --git a/services/mgmt/lib/binary/impl.go b/services/binary/binarylib/client.go
similarity index 97%
rename from services/mgmt/lib/binary/impl.go
rename to services/binary/binarylib/client.go
index aae347a..9b97863 100644
--- a/services/mgmt/lib/binary/impl.go
+++ b/services/binary/binarylib/client.go
@@ -2,11 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package binary provides a client-side library for the binary
-// repository.
-//
+package binarylib
+
 // TODO(jsimsa): Implement parallel download and upload.
-package binary
 
 import (
 	"bytes"
@@ -29,11 +27,9 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/services/mgmt/lib/packages"
+	"v.io/x/ref/services/internal/packages"
 )
 
-const pkgPath = "v.io/x/ref/services/mgmt/lib/binary"
-
 var (
 	errOperationFailed = verror.Register(pkgPath+".errOperationFailed", verror.NoRetry, "{1:}{2:} operation failed{:_}")
 )
diff --git a/services/mgmt/lib/binary/impl_test.go b/services/binary/binarylib/client_test.go
similarity index 91%
rename from services/mgmt/lib/binary/impl_test.go
rename to services/binary/binarylib/client_test.go
index 7bb0543..2d91162 100644
--- a/services/mgmt/lib/binary/impl_test.go
+++ b/services/binary/binarylib/client_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package binary
+package binarylib
 
 import (
 	"bytes"
@@ -19,8 +19,6 @@
 	"v.io/v23/services/repository"
 	"v.io/x/lib/vlog"
 
-	_ "v.io/x/ref/profiles"
-	"v.io/x/ref/services/binary/binarylib"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
 )
@@ -37,9 +35,9 @@
 	if err != nil {
 		t.Fatalf("TempDir() failed: %v", err)
 	}
-	path, perm := filepath.Join(rootDir, binarylib.VersionFile), os.FileMode(0600)
-	if err := ioutil.WriteFile(path, []byte(binarylib.Version), perm); err != nil {
-		vlog.Fatalf("WriteFile(%v, %v, %v) failed: %v", path, binarylib.Version, perm, err)
+	path, perm := filepath.Join(rootDir, VersionFile), os.FileMode(0600)
+	if err := ioutil.WriteFile(path, []byte(Version), perm); err != nil {
+		vlog.Fatalf("WriteFile(%v, %v, %v) failed: %v", path, Version, perm, err)
 	}
 	// Setup and start the binary repository server.
 	server, err := v23.NewServer(ctx)
@@ -47,12 +45,12 @@
 		t.Fatalf("NewServer() failed: %v", err)
 	}
 	depth := 2
-	state, err := binarylib.NewState(rootDir, "http://test-root-url", depth)
+	state, err := NewState(rootDir, "http://test-root-url", depth)
 	if err != nil {
 		t.Fatalf("NewState(%v, %v) failed: %v", rootDir, depth, err)
 	}
 
-	dispatcher, err := binarylib.NewDispatcher(v23.GetPrincipal(ctx), state)
+	dispatcher, err := NewDispatcher(v23.GetPrincipal(ctx), state)
 	if err != nil {
 		t.Fatalf("NewDispatcher() failed: %v\n", err)
 	}
diff --git a/services/binary/binarylib/dispatcher.go b/services/binary/binarylib/dispatcher.go
index 93c268c..9b0b4d9 100644
--- a/services/binary/binarylib/dispatcher.go
+++ b/services/binary/binarylib/dispatcher.go
@@ -11,7 +11,7 @@
 	"v.io/v23/security"
 	"v.io/v23/services/repository"
 
-	"v.io/x/ref/services/mgmt/lib/acls"
+	"v.io/x/ref/services/internal/acls"
 )
 
 const (
diff --git a/services/binary/binarylib/impl_test.go b/services/binary/binarylib/impl_test.go
index 571000a..d8d5a17 100644
--- a/services/binary/binarylib/impl_test.go
+++ b/services/binary/binarylib/impl_test.go
@@ -23,7 +23,7 @@
 
 	_ "v.io/x/ref/profiles/static"
 	"v.io/x/ref/services/binary/binarylib"
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
 )
@@ -35,11 +35,11 @@
 // startServer starts the binary repository server.
 func startServer(t *testing.T, ctx *context.T, depth int) (repository.BinaryClientMethods, string, string, func()) {
 	// Setup the root of the binary repository.
-	rootDir, cleanup := mgmttest.SetupRootDir(t, "bindir")
+	rootDir, cleanup := servicetest.SetupRootDir(t, "bindir")
 	prepDirectory(t, rootDir)
 
 	// Setup and start the binary repository server.
-	server, endpoint := mgmttest.NewServer(ctx)
+	server, endpoint := servicetest.NewServer(ctx)
 
 	listener, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
diff --git a/services/binary/binarylib/service.go b/services/binary/binarylib/service.go
index c73eb0d..71ee821 100644
--- a/services/binary/binarylib/service.go
+++ b/services/binary/binarylib/service.go
@@ -47,7 +47,7 @@
 	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/services/mgmt/lib/acls"
+	"v.io/x/ref/services/internal/acls"
 )
 
 // binaryService implements the Binary server interface.
diff --git a/services/device/device/devicemanager_mock_test.go b/services/device/device/devicemanager_mock_test.go
index 42d502f..c54f1c0 100644
--- a/services/device/device/devicemanager_mock_test.go
+++ b/services/device/device/devicemanager_mock_test.go
@@ -24,8 +24,8 @@
 	"v.io/v23/services/repository"
 	"v.io/x/lib/vlog"
 
-	binlib "v.io/x/ref/services/mgmt/lib/binary"
-	pkglib "v.io/x/ref/services/mgmt/lib/packages"
+	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/packages"
 )
 
 type mockDeviceInvoker struct {
@@ -144,11 +144,11 @@
 	}
 	defer os.RemoveAll(dir)
 	tmpFile := filepath.Join(dir, "downloaded")
-	if err := binlib.DownloadToFile(ctx, pkgVON, tmpFile); err != nil {
+	if err := binarylib.DownloadToFile(ctx, pkgVON, tmpFile); err != nil {
 		return 0, fmt.Errorf("DownloadToFile failed: %v", err)
 	}
 	dst := filepath.Join(dir, "install")
-	if err := pkglib.Install(tmpFile, dst); err != nil {
+	if err := packages.Install(tmpFile, dst); err != nil {
 		return 0, fmt.Errorf("packages.Install failed: %v", err)
 	}
 	return packageSize(dst), nil
@@ -167,7 +167,7 @@
 		is.appName = appNameAfterFetch
 		is.files = make(map[string]int64)
 		// Fetch the binary and record its size in the stimulus.
-		data, mediaInfo, err := binlib.Download(call.Context(), binaryName)
+		data, mediaInfo, err := binarylib.Download(call.Context(), binaryName)
 		if err != nil {
 			return "", err
 		}
diff --git a/services/device/device/local_install.go b/services/device/device/local_install.go
index 2116d91..02bc6b1 100644
--- a/services/device/device/local_install.go
+++ b/services/device/device/local_install.go
@@ -28,7 +28,7 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/lib/cmdline"
-	pkglib "v.io/x/ref/services/mgmt/lib/packages"
+	"v.io/x/ref/services/internal/packages"
 )
 
 var cmdInstallLocal = &cmdline.Command{
@@ -193,7 +193,7 @@
 	}
 	h.Write(bytes)
 	part := binary.PartInfo{Checksum: hex.EncodeToString(h.Sum(nil)), Size: int64(len(bytes))}
-	return []binary.PartInfo{part}, pkglib.MediaInfoForFileName(fileName), nil
+	return []binary.PartInfo{part}, packages.MediaInfoForFileName(fileName), nil
 }
 
 func (binaryInvoker) Upload(repository.BinaryUploadServerCall, int32) error {
@@ -233,7 +233,7 @@
 	// Directory packages first get zip'ped.
 	if info.IsDir() {
 		fileName = filepath.Join(tmpZipDir, info.Name()+".zip")
-		if err := pkglib.CreateZip(fileName, p); err != nil {
+		if err := packages.CreateZip(fileName, p); err != nil {
 			return "", "", err
 		}
 	}
diff --git a/services/device/device/publish.go b/services/device/device/publish.go
index df6a2b1..025162f 100644
--- a/services/device/device/publish.go
+++ b/services/device/device/publish.go
@@ -21,7 +21,7 @@
 	"v.io/v23/verror"
 
 	"v.io/x/lib/cmdline"
-	"v.io/x/ref/services/mgmt/lib/binary"
+	"v.io/x/ref/services/binary/binarylib"
 	"v.io/x/ref/services/repository"
 )
 
@@ -101,7 +101,7 @@
 	binaryVON := naming.Join(binaryService, binaryName, fmt.Sprintf("%s-%s", goos, goarch), timestamp)
 	binaryFile := filepath.Join(binPath, binaryName)
 	// TODO(caprita): Take signature of binary and put it in the envelope.
-	if _, err := binary.UploadFromFile(gctx, binaryVON, binaryFile); err != nil {
+	if _, err := binarylib.UploadFromFile(gctx, binaryVON, binaryFile); err != nil {
 		return err
 	}
 	fmt.Fprintf(cmd.Stdout(), "Binary %q uploaded from file %s\n", binaryVON, binaryFile)
diff --git a/services/device/internal/impl/acl_propagator.go b/services/device/internal/impl/acl_propagator.go
index 944ea60..37cfa38 100644
--- a/services/device/internal/impl/acl_propagator.go
+++ b/services/device/internal/impl/acl_propagator.go
@@ -10,7 +10,7 @@
 	"v.io/v23/security"
 	"v.io/v23/security/access"
 
-	"v.io/x/ref/services/mgmt/lib/acls"
+	"v.io/x/ref/services/internal/acls"
 )
 
 // computePath builds the desired path for the debug acls.
diff --git a/services/device/internal/impl/app_service.go b/services/device/internal/impl/app_service.go
index f6e5e70..06e18e0 100644
--- a/services/device/internal/impl/app_service.go
+++ b/services/device/internal/impl/app_service.go
@@ -157,8 +157,8 @@
 	"v.io/x/ref/security/agent"
 	"v.io/x/ref/security/agent/keymgr"
 	"v.io/x/ref/services/device/internal/config"
-	"v.io/x/ref/services/mgmt/lib/acls"
-	libpackages "v.io/x/ref/services/mgmt/lib/packages"
+	"v.io/x/ref/services/internal/acls"
+	"v.io/x/ref/services/internal/packages"
 )
 
 // instanceInfo holds state about a running instance.
@@ -650,11 +650,11 @@
 	if err := os.MkdirAll(packagesDir, os.FileMode(0755)); err != nil {
 		return err
 	}
-	installFrom := func(packages application.Packages, sourceDir string) error {
-		for pkg, _ := range packages {
+	installFrom := func(pkgs application.Packages, sourceDir string) error {
+		for pkg, _ := range pkgs {
 			pkgFile := filepath.Join(sourceDir, "pkg", pkg)
 			dst := filepath.Join(packagesDir, pkg)
-			if err := libpackages.Install(pkgFile, dst); err != nil {
+			if err := packages.Install(pkgFile, dst); err != nil {
 				return err
 			}
 		}
diff --git a/services/device/internal/impl/claim.go b/services/device/internal/impl/claim.go
index d58e9b2..921b1f2 100644
--- a/services/device/internal/impl/claim.go
+++ b/services/device/internal/impl/claim.go
@@ -15,7 +15,7 @@
 	"v.io/v23/security/access"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/services/mgmt/lib/acls"
+	"v.io/x/ref/services/internal/acls"
 )
 
 // claimable implements the device.Claimable RPC interface and the
diff --git a/services/device/internal/impl/debug_acls_test.go b/services/device/internal/impl/debug_acls_test.go
index 57448c6..629998d 100644
--- a/services/device/internal/impl/debug_acls_test.go
+++ b/services/device/internal/impl/debug_acls_test.go
@@ -16,7 +16,7 @@
 	"v.io/v23/services/permissions"
 	"v.io/v23/verror"
 
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test/testutil"
 )
 
@@ -43,8 +43,8 @@
 	defer cleanup()
 
 	// Set up the device manager.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
 	claimDevice(t, ctx, "dm", "mydevice", noPairingToken)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -198,8 +198,8 @@
 	}
 
 	// Set up the device manager.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "--log_dir="+extraLogDir, "dm", root, helperPath, "unused", "unused_curr_link")
-	mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "--log_dir="+extraLogDir, "dm", root, helperPath, "unused", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
 
 	// Make some users.
 	selfCtx := ctx
diff --git a/services/device/internal/impl/dispatcher.go b/services/device/internal/impl/dispatcher.go
index 459d8ec..1935cfe 100644
--- a/services/device/internal/impl/dispatcher.go
+++ b/services/device/internal/impl/dispatcher.go
@@ -16,8 +16,8 @@
 	"v.io/x/ref/security/agent/keymgr"
 	s_device "v.io/x/ref/services/device"
 	"v.io/x/ref/services/device/internal/config"
+	"v.io/x/ref/services/internal/acls"
 	"v.io/x/ref/services/logreader/logreaderlib"
-	"v.io/x/ref/services/mgmt/lib/acls"
 
 	"v.io/v23"
 	"v.io/v23/context"
diff --git a/services/device/internal/impl/impl_test.go b/services/device/internal/impl/impl_test.go
index 4cc758d..8533727 100644
--- a/services/device/internal/impl/impl_test.go
+++ b/services/device/internal/impl/impl_test.go
@@ -50,8 +50,7 @@
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/device/internal/starter"
-	libbinary "v.io/x/ref/services/mgmt/lib/binary"
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/expect"
 	"v.io/x/ref/test/modules"
@@ -287,7 +286,7 @@
 	}
 	publishName := args[0]
 
-	server, _ := mgmttest.NewServer(ctx)
+	server, _ := servicetest.NewServer(ctx)
 	defer server.Stop()
 	if err := server.Serve(publishName, new(appService), nil); err != nil {
 		vlog.Fatalf("Serve(%v) failed: %v", publishName, err)
@@ -349,14 +348,14 @@
 	ctx, shutdown := initForTest()
 	defer shutdown()
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, v23.GetPrincipal(ctx))
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, v23.GetPrincipal(ctx))
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
 	envelope, cleanup := startMockRepos(t, ctx)
 	defer cleanup()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -398,12 +397,12 @@
 	// demonstrates that the initial device manager could be started by hand
 	// as long as the right initial configuration is passed into the device
 	// manager implementation.
-	dmh := mgmttest.RunCommand(t, sh, dmPauseBeforeStopEnv, deviceManagerCmd, dmArgs...)
+	dmh := servicetest.RunCommand(t, sh, dmPauseBeforeStopEnv, deviceManagerCmd, dmArgs...)
 	defer func() {
 		syscall.Kill(dmh.Pid(), syscall.SIGINT)
 	}()
 
-	mgmttest.ReadPID(t, dmh)
+	servicetest.ReadPID(t, dmh)
 	// Brand new device manager must be claimed first.
 	claimDevice(t, ctx, "factoryDM", "mydevice", noPairingToken)
 
@@ -444,9 +443,9 @@
 	// relaunch it from the current link.
 	resolveExpectNotFound(t, ctx, "v2DM") // Ensure a clean slate.
 
-	dmh = mgmttest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
 
-	mgmttest.ReadPID(t, dmh)
+	servicetest.ReadPID(t, dmh)
 	resolve(t, ctx, "v2DM", 1) // Current link should have been launching v2.
 
 	// Try issuing an update without changing the envelope in the
@@ -485,9 +484,9 @@
 	// Re-lanuch the device manager from current link.  We instruct the
 	// device manager to pause before stopping its server, so that we can
 	// verify that a second revert fails while a revert is in progress.
-	dmh = mgmttest.RunCommand(t, sh, dmPauseBeforeStopEnv, execScriptCmd, currLink)
+	dmh = servicetest.RunCommand(t, sh, dmPauseBeforeStopEnv, execScriptCmd, currLink)
 
-	mgmttest.ReadPID(t, dmh)
+	servicetest.ReadPID(t, dmh)
 	resolve(t, ctx, "v3DM", 1) // Current link should have been launching v3.
 
 	// Revert the device manager to its previous version (v2).
@@ -503,8 +502,8 @@
 
 	resolveExpectNotFound(t, ctx, "v2DM") // Ensure a clean slate.
 
-	dmh = mgmttest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
-	mgmttest.ReadPID(t, dmh)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	servicetest.ReadPID(t, dmh)
 	resolve(t, ctx, "v2DM", 1) // Current link should have been launching v2.
 
 	// Revert the device manager to its previous version (factory).
@@ -518,8 +517,8 @@
 
 	resolveExpectNotFound(t, ctx, "factoryDM") // Ensure a clean slate.
 
-	dmh = mgmttest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
-	mgmttest.ReadPID(t, dmh)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	servicetest.ReadPID(t, dmh)
 	resolve(t, ctx, "factoryDM", 1) // Current link should have been launching factory version.
 	stopDevice(t, ctx, "factoryDM")
 	dmh.Expect("factoryDM terminated")
@@ -527,8 +526,8 @@
 
 	// Re-launch the device manager, to exercise the behavior of Suspend.
 	resolveExpectNotFound(t, ctx, "factoryDM") // Ensure a clean slate.
-	dmh = mgmttest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
-	mgmttest.ReadPID(t, dmh)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, execScriptCmd, currLink)
+	servicetest.ReadPID(t, dmh)
 	resolve(t, ctx, "factoryDM", 1)
 	suspendDevice(t, ctx, "factoryDM")
 	dmh.Expect("restart handler")
@@ -550,7 +549,7 @@
 // returns a channel on which the app's ping message is returned, and a cleanup
 // function.
 func setupPingServer(t *testing.T, ctx *context.T) (<-chan pingArgs, func()) {
-	server, _ := mgmttest.NewServer(ctx)
+	server, _ := servicetest.NewServer(ctx)
 	pingCh := make(chan pingArgs, 1)
 	if err := server.Serve("pingserver", pingServer(pingCh), &openAuthorizer{}); err != nil {
 		t.Fatalf("Serve(%q, <dispatcher>) failed: %v", "pingserver", err)
@@ -614,14 +613,14 @@
 	ctx, shutdown := initForTest()
 	defer shutdown()
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
 	envelope, cleanup := startMockRepos(t, ctx)
 	defer cleanup()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -632,8 +631,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
 	claimDevice(t, ctx, "dm", "mydevice", noPairingToken)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -867,7 +866,7 @@
 	if err != nil {
 		t.Fatalf("binarylib.NewState failed: %v", err)
 	}
-	server, _ := mgmttest.NewServer(ctx)
+	server, _ := servicetest.NewServer(ctx)
 	d, err := binarylib.NewDispatcher(v23.GetPrincipal(ctx), state)
 	if err != nil {
 		t.Fatalf("server.NewDispatcher failed: %v", err)
@@ -898,14 +897,14 @@
 		t.Fatal(err)
 	}
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
 	envelope, cleanup := startMockRepos(t, ctx)
 	defer cleanup()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -917,8 +916,8 @@
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
 	pairingToken := "abcxyz"
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link", pairingToken)
-	pid := mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link", pairingToken)
+	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	*envelope = envelopeFromShell(sh, nil, appCmd, "google naps", "trapp")
@@ -984,14 +983,14 @@
 	idp := testutil.NewIDProvider("root")
 	ctx = ctxWithNewPrincipal(t, ctx, idp, "self")
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
 	envelope, cleanup := startMockRepos(t, ctx)
 	defer cleanup()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -1002,8 +1001,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
-	pid := mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create an envelope for an app.
@@ -1072,9 +1071,9 @@
 	ctx, shutdown := initForTest()
 	defer shutdown()
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
-	testDir, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	testDir, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	// No need to call SaveCreatorInfo() here because that's part of SelfInstall below
 
@@ -1103,8 +1102,8 @@
 	if err := impl.Start(dmDir, os.Stderr, stdout); err != nil {
 		t.Fatalf("Start failed: %v", err)
 	}
-	dms := expect.NewSession(t, stdout, mgmttest.ExpectTimeout)
-	mgmttest.ReadPID(t, dms)
+	dms := expect.NewSession(t, stdout, servicetest.ExpectTimeout)
+	servicetest.ReadPID(t, dms)
 	claimDevice(t, ctx, "dm", "mydevice", noPairingToken)
 	revertDeviceExpectError(t, ctx, "dm", impl.ErrUpdateNoOp.ID) // No previous version available.
 
@@ -1132,14 +1131,14 @@
 	ctx, shutdown := initForTest()
 	defer shutdown()
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
 	envelope, cleanup := startMockRepos(t, ctx)
 	defer cleanup()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -1150,8 +1149,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -1234,7 +1233,7 @@
 	ctx, shutdown := initForTest()
 	defer shutdown()
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -1256,13 +1255,13 @@
 		}
 	}
 	createFile("hello.txt", "Hello World!")
-	if _, err := libbinary.UploadFromDir(ctx, naming.Join(binaryVON, "testpkg"), tmpdir); err != nil {
-		t.Fatalf("libbinary.UploadFromDir failed: %v", err)
+	if _, err := binarylib.UploadFromDir(ctx, naming.Join(binaryVON, "testpkg"), tmpdir); err != nil {
+		t.Fatalf("binarylib.UploadFromDir failed: %v", err)
 	}
 	createAndUpload := func(von, contents string) {
 		createFile("tempfile", contents)
-		if _, err := libbinary.UploadFromFile(ctx, naming.Join(binaryVON, von), filepath.Join(tmpdir, "tempfile")); err != nil {
-			t.Fatalf("libbinary.UploadFromFile failed: %v", err)
+		if _, err := binarylib.UploadFromFile(ctx, naming.Join(binaryVON, von), filepath.Join(tmpdir, "tempfile")); err != nil {
+			t.Fatalf("binarylib.UploadFromFile failed: %v", err)
 		}
 	}
 	createAndUpload("testfile", "Goodbye World!")
@@ -1270,7 +1269,7 @@
 	createAndUpload("rightshark", "Right shark")
 	createAndUpload("beachball", "Beach ball")
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -1281,8 +1280,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -1376,10 +1375,10 @@
 	ctx, shutdown := initForTest()
 	defer shutdown()
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -1398,8 +1397,8 @@
 		v23.GetPrincipal(c).AddToRoots(v23.GetPrincipal(ctx).BlessingStore().Default())
 	}
 
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
-	pid := mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
+	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	deviceStub := device.DeviceClient("dm/device")
@@ -1478,14 +1477,14 @@
 		t.Fatal(err)
 	}
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
 	envelope, cleanup := startMockRepos(t, ctx)
 	defer cleanup()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -1497,8 +1496,8 @@
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "-mocksetuid", "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "-mocksetuid", "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 	// Claim the devicemanager with selfCtx as root/self/alice
 	claimDevice(t, selfCtx, "dm", "alice", noPairingToken)
@@ -1607,7 +1606,7 @@
 	ctx, shutdown := initForTest()
 	defer shutdown()
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 	defer deferFn()
 
 	binaryVON := "binary"
@@ -1616,7 +1615,7 @@
 
 	up := testutil.RandomBytes(testutil.Intn(5 << 20))
 	mediaInfo := repository.MediaInfo{Type: "application/octet-stream"}
-	sig, err := libbinary.Upload(ctx, naming.Join(binaryVON, "testbinary"), up, mediaInfo)
+	sig, err := binarylib.Upload(ctx, naming.Join(binaryVON, "testbinary"), up, mediaInfo)
 	if err != nil {
 		t.Fatalf("Upload(%v) failed:%v", binaryVON, err)
 	}
@@ -1631,16 +1630,16 @@
 	if err := ioutil.WriteFile(filepath.Join(tmpdir, "pkg.txt"), pkgContents, 0600); err != nil {
 		t.Fatalf("ioutil.WriteFile failed: %v", err)
 	}
-	pkgSig, err := libbinary.UploadFromDir(ctx, pkgVON, tmpdir)
+	pkgSig, err := binarylib.UploadFromDir(ctx, pkgVON, tmpdir)
 	if err != nil {
-		t.Fatalf("libbinary.UploadFromDir failed: %v", err)
+		t.Fatalf("binarylib.UploadFromDir failed: %v", err)
 	}
 
 	// Start the application repository
 	envelope, serverStop := startApplicationRepository(ctx)
 	defer serverStop()
 
-	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, cleanup := servicetest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
@@ -1651,8 +1650,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	pid := mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	pid := servicetest.ReadPID(t, dmh)
 	defer syscall.Kill(pid, syscall.SIGINT)
 	claimDevice(t, ctx, "dm", "mydevice", noPairingToken)
 
@@ -1679,10 +1678,10 @@
 
 	// Verify that when the binary is corrupted, signature verification fails.
 	up[0] = up[0] ^ 0xFF
-	if err := libbinary.Delete(ctx, naming.Join(binaryVON, "testbinary")); err != nil {
+	if err := binarylib.Delete(ctx, naming.Join(binaryVON, "testbinary")); err != nil {
 		t.Fatalf("Delete(%v) failed:%v", binaryVON, err)
 	}
-	if _, err := libbinary.Upload(ctx, naming.Join(binaryVON, "testbinary"), up, mediaInfo); err != nil {
+	if _, err := binarylib.Upload(ctx, naming.Join(binaryVON, "testbinary"), up, mediaInfo); err != nil {
 		t.Fatalf("Upload(%v) failed:%v", binaryVON, err)
 	}
 	if _, err := appStub().Install(ctx, mockApplicationRepoName, device.Config{}, nil); verror.ErrorID(err) != impl.ErrOperationFailed.ID {
@@ -1691,10 +1690,10 @@
 
 	// Restore the binary and verify that installation succeeds.
 	up[0] = up[0] ^ 0xFF
-	if err := libbinary.Delete(ctx, naming.Join(binaryVON, "testbinary")); err != nil {
+	if err := binarylib.Delete(ctx, naming.Join(binaryVON, "testbinary")); err != nil {
 		t.Fatalf("Delete(%v) failed:%v", binaryVON, err)
 	}
-	if _, err := libbinary.Upload(ctx, naming.Join(binaryVON, "testbinary"), up, mediaInfo); err != nil {
+	if _, err := binarylib.Upload(ctx, naming.Join(binaryVON, "testbinary"), up, mediaInfo); err != nil {
 		t.Fatalf("Upload(%v) failed:%v", binaryVON, err)
 	}
 	if _, err := appStub().Install(ctx, mockApplicationRepoName, device.Config{}, nil); err != nil {
@@ -1703,7 +1702,7 @@
 
 	// Verify that when the package contents are corrupted, signature verification fails.
 	pkgContents[0] = pkgContents[0] ^ 0xFF
-	if err := libbinary.Delete(ctx, pkgVON); err != nil {
+	if err := binarylib.Delete(ctx, pkgVON); err != nil {
 		t.Fatalf("Delete(%v) failed:%v", pkgVON, err)
 	}
 	if err := os.Remove(filepath.Join(tmpdir, "pkg.txt")); err != nil {
@@ -1712,8 +1711,8 @@
 	if err := ioutil.WriteFile(filepath.Join(tmpdir, "pkg.txt"), pkgContents, 0600); err != nil {
 		t.Fatalf("ioutil.WriteFile failed: %v", err)
 	}
-	if _, err = libbinary.UploadFromDir(ctx, pkgVON, tmpdir); err != nil {
-		t.Fatalf("libbinary.UploadFromDir failed: %v", err)
+	if _, err = binarylib.UploadFromDir(ctx, pkgVON, tmpdir); err != nil {
+		t.Fatalf("binarylib.UploadFromDir failed: %v", err)
 	}
 	if _, err := appStub().Install(ctx, mockApplicationRepoName, device.Config{}, nil); verror.ErrorID(err) != impl.ErrOperationFailed.ID {
 		t.Fatalf("Failed to verify signature mismatch for package:%v", pkgVON)
diff --git a/services/device/internal/impl/instance_reaping_test.go b/services/device/internal/impl/instance_reaping_test.go
index 8b0e906..bac5e15 100644
--- a/services/device/internal/impl/instance_reaping_test.go
+++ b/services/device/internal/impl/instance_reaping_test.go
@@ -19,7 +19,7 @@
 	"v.io/v23/vdl"
 
 	"v.io/x/ref/envvar"
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 )
 
 func TestReaperNoticesAppDeath(t *testing.T) {
@@ -28,8 +28,8 @@
 
 	// Set up the device manager.  Since we won't do device manager updates,
 	// don't worry about its application envelope and current link.
-	dmh := mgmttest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, nil, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
 	claimDevice(t, ctx, "dm", "mydevice", noPairingToken)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -107,8 +107,8 @@
 	defer os.RemoveAll(dmCreds)
 	dmEnv := []string{fmt.Sprintf("%v=%v", envvar.Credentials, dmCreds)}
 
-	dmh := mgmttest.RunCommand(t, sh, dmEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	mgmttest.ReadPID(t, dmh)
+	dmh := servicetest.RunCommand(t, sh, dmEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
 	claimDevice(t, ctx, "dm", "mydevice", noPairingToken)
 
 	// Create the local server that the app uses to let us know it's ready.
@@ -152,8 +152,8 @@
 	}
 
 	// Run another device manager to replace the dead one.
-	dmh = mgmttest.RunCommand(t, sh, dmEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
-	mgmttest.ReadPID(t, dmh)
+	dmh = servicetest.RunCommand(t, sh, dmEnv, deviceManagerCmd, "dm", root, helperPath, "unused_app_repo_name", "unused_curr_link")
+	servicetest.ReadPID(t, dmh)
 	resolve(t, ctx, "dm", 1) // Verify the device manager has published itself.
 
 	// By now, we've reconciled the state of the tree with which processes
diff --git a/services/device/internal/impl/mock_repo_test.go b/services/device/internal/impl/mock_repo_test.go
index 511b784..c249f73 100644
--- a/services/device/internal/impl/mock_repo_test.go
+++ b/services/device/internal/impl/mock_repo_test.go
@@ -23,7 +23,7 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 )
 
 const mockBinaryRepoName = "br"
@@ -43,7 +43,7 @@
 // repository.  It returns a pointer to the envelope that the repository returns
 // to clients (so that it can be changed).  It also returns a cleanup function.
 func startApplicationRepository(ctx *context.T) (*application.Envelope, func()) {
-	server, _ := mgmttest.NewServer(ctx)
+	server, _ := servicetest.NewServer(ctx)
 	invoker := new(arInvoker)
 	name := mockApplicationRepoName
 	if err := server.Serve(name, repository.ApplicationServer(invoker), &openAuthorizer{}); err != nil {
@@ -91,7 +91,7 @@
 // startBinaryRepository sets up a server running the binary repository and
 // returns a cleanup function.
 func startBinaryRepository(ctx *context.T) func() {
-	server, _ := mgmttest.NewServer(ctx)
+	server, _ := servicetest.NewServer(ctx)
 	name := mockBinaryRepoName
 	if err := server.Serve(name, repository.BinaryServer(new(brInvoker)), &openAuthorizer{}); err != nil {
 		vlog.Fatalf("Serve(%q) failed: %v", name, err)
diff --git a/services/device/internal/impl/util.go b/services/device/internal/impl/util.go
index fa9bad6..36ec927 100644
--- a/services/device/internal/impl/util.go
+++ b/services/device/internal/impl/util.go
@@ -14,8 +14,8 @@
 	"strings"
 	"time"
 
+	"v.io/x/ref/services/binary/binarylib"
 	"v.io/x/ref/services/device/internal/config"
-	"v.io/x/ref/services/mgmt/lib/binary"
 
 	"v.io/v23/context"
 	"v.io/v23/security"
@@ -46,7 +46,7 @@
 func downloadBinary(ctx *context.T, publisher security.Blessings, bin *application.SignedFile, workspace, fileName string) error {
 	// TODO(gauthamt): Reduce the number of passes we make over the binary/package
 	// data to verify its checksum and signature.
-	data, _, err := binary.Download(ctx, bin.File)
+	data, _, err := binarylib.Download(ctx, bin.File)
 	if err != nil {
 		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("Download(%v) failed: %v", bin.File, err))
 	}
@@ -67,7 +67,7 @@
 			return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("invalid local package name: %q", localPkg))
 		}
 		path := filepath.Join(pkgDir, localPkg)
-		if err := binary.DownloadToFile(ctx, pkgName.File, path); err != nil {
+		if err := binarylib.DownloadToFile(ctx, pkgName.File, path); err != nil {
 			return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("DownloadToFile(%q, %q) failed: %v", pkgName, path, err))
 		}
 		data, err := ioutil.ReadFile(path)
diff --git a/services/device/internal/impl/util_test.go b/services/device/internal/impl/util_test.go
index 4d66f34..1658f95 100644
--- a/services/device/internal/impl/util_test.go
+++ b/services/device/internal/impl/util_test.go
@@ -34,7 +34,7 @@
 
 	_ "v.io/x/ref/profiles/roaming"
 	"v.io/x/ref/services/device/internal/impl"
-	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/modules"
 	"v.io/x/ref/test/testutil"
@@ -463,12 +463,12 @@
 	idp := testutil.NewIDProvider("root")
 	ctx = ctxWithNewPrincipal(t, ctx, idp, "self")
 
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, ctx, nil)
+	sh, deferFn := servicetest.CreateShellAndMountTable(t, ctx, nil)
 
 	// Set up mock application and binary repositories.
 	envelope, envCleanup := startMockRepos(t, ctx)
 
-	root, rootCleanup := mgmttest.SetupRootDir(t, "devicemanager")
+	root, rootCleanup := servicetest.SetupRootDir(t, "devicemanager")
 	if err := impl.SaveCreatorInfo(root); err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/device/internal/starter/starter.go b/services/device/internal/starter/starter.go
index d771c3d..b0a636c 100644
--- a/services/device/internal/starter/starter.go
+++ b/services/device/internal/starter/starter.go
@@ -19,7 +19,7 @@
 	"v.io/x/ref/services/debug/debuglib"
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/impl"
-	"v.io/x/ref/services/mgmt/lib/acls"
+	"v.io/x/ref/services/internal/acls"
 	"v.io/x/ref/services/mounttable/mounttablelib"
 
 	"v.io/v23"
diff --git a/services/mgmt/lib/acls/aclaccess.go b/services/internal/acls/aclaccess.go
similarity index 98%
rename from services/mgmt/lib/acls/aclaccess.go
rename to services/internal/acls/aclaccess.go
index 42d4154..325b5dd 100644
--- a/services/mgmt/lib/acls/aclaccess.go
+++ b/services/internal/acls/aclaccess.go
@@ -24,7 +24,7 @@
 )
 
 const (
-	pkgPath = "v.io/x/ref/services/mgmt/lib/acls"
+	pkgPath = "v.io/x/ref/services/internal/acls"
 	sigName = "signature"
 	aclName = "data"
 )
diff --git a/services/mgmt/lib/acls/etag.go b/services/internal/acls/etag.go
similarity index 100%
rename from services/mgmt/lib/acls/etag.go
rename to services/internal/acls/etag.go
diff --git a/services/mgmt/lib/acls/hierarchical_authorizer.go b/services/internal/acls/hierarchical_authorizer.go
similarity index 100%
rename from services/mgmt/lib/acls/hierarchical_authorizer.go
rename to services/internal/acls/hierarchical_authorizer.go
diff --git a/services/mgmt/lib/fs/only_for_test.go b/services/internal/fs/only_for_test.go
similarity index 100%
rename from services/mgmt/lib/fs/only_for_test.go
rename to services/internal/fs/only_for_test.go
diff --git a/services/mgmt/lib/fs/simplestore.go b/services/internal/fs/simplestore.go
similarity index 99%
rename from services/mgmt/lib/fs/simplestore.go
rename to services/internal/fs/simplestore.go
index 7d9c1c8..d51cca1 100644
--- a/services/mgmt/lib/fs/simplestore.go
+++ b/services/internal/fs/simplestore.go
@@ -27,7 +27,7 @@
 // TODO(rjkroege@google.com) Switch Memstore to the mid-August 2014
 // style store API.
 
-const pkgPath = "v.io/x/ref/services/mgmt/lib/fs"
+const pkgPath = "v.io/x/ref/services/internal/fs"
 
 // Errors
 var (
diff --git a/services/mgmt/lib/fs/simplestore_test.go b/services/internal/fs/simplestore_test.go
similarity index 99%
rename from services/mgmt/lib/fs/simplestore_test.go
rename to services/internal/fs/simplestore_test.go
index a929596..0960235 100644
--- a/services/mgmt/lib/fs/simplestore_test.go
+++ b/services/internal/fs/simplestore_test.go
@@ -14,7 +14,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/services/application"
 	"v.io/v23/verror"
-	"v.io/x/ref/services/mgmt/lib/fs"
+	"v.io/x/ref/services/internal/fs"
 	_ "v.io/x/ref/services/profile"
 )
 
diff --git a/services/mgmt/lib/packages/packages.go b/services/internal/packages/packages.go
similarity index 98%
rename from services/mgmt/lib/packages/packages.go
rename to services/internal/packages/packages.go
index 2522a04..3f9af83 100644
--- a/services/mgmt/lib/packages/packages.go
+++ b/services/internal/packages/packages.go
@@ -38,7 +38,7 @@
 	".tar.bz2": repository.MediaInfo{Type: "application/x-tar", Encoding: "bzip2"},
 }
 
-const pkgPath = "v.io/x/ref/services/mgmt/lib/packages"
+const pkgPath = "v.io/x/ref/services/internal/packages"
 
 var (
 	errBadMediaType    = verror.Register(pkgPath+".errBadMediaType", verror.NoRetry, "{1:}{2:} unsupported media type{:_}")
diff --git a/services/mgmt/lib/packages/packages_test.go b/services/internal/packages/packages_test.go
similarity index 99%
rename from services/mgmt/lib/packages/packages_test.go
rename to services/internal/packages/packages_test.go
index 43a062d..a6b130c 100644
--- a/services/mgmt/lib/packages/packages_test.go
+++ b/services/internal/packages/packages_test.go
@@ -18,7 +18,7 @@
 
 	"v.io/v23/services/repository"
 
-	"v.io/x/ref/services/mgmt/lib/packages"
+	"v.io/x/ref/services/internal/packages"
 )
 
 func TestInstall(t *testing.T) {
diff --git a/services/mgmt/lib/testutil/modules.go b/services/internal/servicetest/modules.go
similarity index 99%
rename from services/mgmt/lib/testutil/modules.go
rename to services/internal/servicetest/modules.go
index 1544b32..9883ebc 100644
--- a/services/mgmt/lib/testutil/modules.go
+++ b/services/internal/servicetest/modules.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package testutil
+package servicetest
 
 import (
 	"fmt"
diff --git a/services/mgmt/lib/testutil/timeouts.go b/services/internal/servicetest/timeouts.go
similarity index 93%
rename from services/mgmt/lib/testutil/timeouts.go
rename to services/internal/servicetest/timeouts.go
index 38888a4..bae8ff7 100644
--- a/services/mgmt/lib/testutil/timeouts.go
+++ b/services/internal/servicetest/timeouts.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package testutil
+package servicetest
 
 import (
 	"time"
diff --git a/services/mgmt/lib/binary/v23_internal_test.go b/services/mgmt/lib/binary/v23_internal_test.go
deleted file mode 100644
index fe3cb00..0000000
--- a/services/mgmt/lib/binary/v23_internal_test.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// This file was auto-generated via go generate.
-// DO NOT UPDATE MANUALLY
-package binary
-
-import "testing"
-import "os"
-
-import "v.io/x/ref/test"
-
-func TestMain(m *testing.M) {
-	test.Init()
-	os.Exit(m.Run())
-}
diff --git a/services/profile/profiled/dispatcher.go b/services/profile/profiled/dispatcher.go
index 171b7f8..16f386f 100644
--- a/services/profile/profiled/dispatcher.go
+++ b/services/profile/profiled/dispatcher.go
@@ -10,7 +10,7 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 
-	"v.io/x/ref/services/mgmt/lib/fs"
+	"v.io/x/ref/services/internal/fs"
 	"v.io/x/ref/services/repository"
 )
 
diff --git a/services/profile/profiled/service.go b/services/profile/profiled/service.go
index 7b0cc1b..23e11b2 100644
--- a/services/profile/profiled/service.go
+++ b/services/profile/profiled/service.go
@@ -7,7 +7,7 @@
 import (
 	"errors"
 
-	"v.io/x/ref/services/mgmt/lib/fs"
+	"v.io/x/ref/services/internal/fs"
 	"v.io/x/ref/services/profile"
 	"v.io/x/ref/services/repository"