core: Remove the NewClient and Client methods of Runtime.

This is part of the runtimeX migration.

Change-Id: Ie112d144854fbe498797a7e9545200614d144222
diff --git a/lib/modules/core/echo.go b/lib/modules/core/echo.go
index ad3901e..de07924 100644
--- a/lib/modules/core/echo.go
+++ b/lib/modules/core/echo.go
@@ -6,6 +6,7 @@
 	"os"
 	"time"
 
+	"v.io/core/veyron2"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/rt"
@@ -94,7 +95,7 @@
 	args = args[1:]
 	name := args[0]
 	args = args[1:]
-	client := runtime.Client()
+	client := veyron2.GetClient(runtime.NewContext())
 	for _, a := range args {
 		ctxt := runtime.NewContext()
 		h, err := client.StartCall(ctxt, name, "Echo", []interface{}{a})
diff --git a/lib/testutil/glob.go b/lib/testutil/glob.go
index f6041c1..84d7ec7 100644
--- a/lib/testutil/glob.go
+++ b/lib/testutil/glob.go
@@ -13,7 +13,7 @@
 // GlobName calls __Glob on the given object with the given pattern and returns
 // a sorted list of matching object names, or an error.
 func GlobName(ctx *context.T, name, pattern string) ([]string, error) {
-	client := ctx.Runtime().(veyron2.Runtime).Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, ipc.GlobMethod, []interface{}{pattern})
 	if err != nil {
 		return nil, err
diff --git a/runtimes/google/ipc/benchmark/glob/glob_test.go b/runtimes/google/ipc/benchmark/glob/glob_test.go
index 1cd67d2..8236d23 100644
--- a/runtimes/google/ipc/benchmark/glob/glob_test.go
+++ b/runtimes/google/ipc/benchmark/glob/glob_test.go
@@ -5,6 +5,7 @@
 	"testing"
 
 	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/rt"
@@ -132,8 +133,9 @@
 	return ch, nil
 }
 
-func globClient(b *testing.B, rt veyron2.Runtime, name string) (int, error) {
-	call, err := rt.Client().StartCall(rt.NewContext(), name, ipc.GlobMethod, []interface{}{"*"})
+func globClient(b *testing.B, ctx *context.T, name string) (int, error) {
+	client := veyron2.GetClient(ctx)
+	call, err := client.StartCall(ctx, name, ipc.GlobMethod, []interface{}{"*"})
 	if err != nil {
 		return 0, err
 	}
@@ -165,7 +167,7 @@
 	}
 	defer stop()
 
-	count, err := globClient(b, runtime, addr)
+	count, err := globClient(b, runtime.NewContext(), addr)
 	if err != nil {
 		b.Fatalf("globClient failed: %v", err)
 	}
diff --git a/runtimes/google/ipc/client_test.go b/runtimes/google/ipc/client_test.go
index 0819f88..adf18d8 100644
--- a/runtimes/google/ipc/client_test.go
+++ b/runtimes/google/ipc/client_test.go
@@ -11,6 +11,7 @@
 
 	"v.io/core/veyron2"
 	"v.io/core/veyron2/context"
+	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/rt"
 	verror "v.io/core/veyron2/verror2"
@@ -24,6 +25,7 @@
 )
 
 var r veyron2.Runtime
+var client ipc.Client
 
 func init() {
 	modules.RegisterChild("ping", "<name>", childPing)
@@ -31,6 +33,7 @@
 	if r, err = rt.New(); err != nil {
 		panic(err)
 	}
+	client = veyron2.GetClient(r.NewContext())
 
 	r.Namespace().CacheCtl(naming.DisableCache(true))
 }
@@ -150,7 +153,6 @@
 }
 
 func TestTimeoutCall(t *testing.T) {
-	client := r.Client()
 	ctx, _ := context.WithTimeout(r.NewContext(), 100*time.Millisecond)
 	name := naming.JoinAddressName(naming.FormatEndpoint("tcp", "203.0.113.10:443"), "")
 	_, err := client.StartCall(ctx, name, "echo", []interface{}{"args don't matter"})
@@ -161,7 +163,7 @@
 
 func childPing(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	name := args[1]
-	call, err := r.Client().StartCall(r.NewContext(), name, "Ping", nil)
+	call, err := client.StartCall(r.NewContext(), name, "Ping", nil)
 	if err != nil {
 		fmt.Errorf("unexpected error: %s", err)
 	}
@@ -220,7 +222,7 @@
 	name, fn := initServer(t, r)
 	defer fn()
 	ctx, _ := context.WithTimeout(r.NewContext(), 100*time.Millisecond)
-	call, err := r.Client().StartCall(ctx, name, "Sleep", nil)
+	call, err := client.StartCall(ctx, name, "Sleep", nil)
 	if err != nil {
 		testForVerror(t, err, verror.Timeout, verror.BadProtocol)
 		return
@@ -234,14 +236,14 @@
 	name, fn := initServer(t, r)
 	defer fn()
 
-	call, err := r.Client().StartCall(r.NewContext(), name, "Sleep", []interface{}{"too many args"})
+	call, err := client.StartCall(r.NewContext(), name, "Sleep", []interface{}{"too many args"})
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	verr := call.Finish(&err)
 	testForVerror(t, verr, verror.BadProtocol)
 
-	call, err = r.Client().StartCall(r.NewContext(), name, "Ping", nil)
+	call, err = client.StartCall(r.NewContext(), name, "Ping", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -261,8 +263,9 @@
 	name, fn := initServer(t, r1)
 	defer fn()
 
-	client := r2.Client()
-	call, err := client.StartCall(r2.NewContext(), name, "Sleep", nil)
+	ctx2 := r2.NewContext()
+	client2 := veyron2.GetClient(ctx2)
+	call, err := client2.StartCall(ctx2, name, "Sleep", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -275,7 +278,7 @@
 	defer fn()
 
 	ctx, cancel := context.WithCancel(r.NewContext())
-	call, err := r.Client().StartCall(ctx, name, "Sleep", nil)
+	call, err := client.StartCall(ctx, name, "Sleep", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -291,7 +294,7 @@
 	defer fn()
 
 	ctx, cancel := context.WithCancel(r.NewContext())
-	call, err := r.Client().StartCall(ctx, name, "Sleep", nil)
+	call, err := client.StartCall(ctx, name, "Sleep", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -323,7 +326,7 @@
 	}
 	go startServer()
 
-	call, err := r.Client().StartCall(r.NewContext(), name, "Echo", []interface{}{"hello"})
+	call, err := client.StartCall(r.NewContext(), name, "Echo", []interface{}{"hello"})
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -362,7 +365,7 @@
 
 	want := 10
 	ctx, _ := context.WithTimeout(r.NewContext(), 300*time.Millisecond)
-	call, err := r.Client().StartCall(ctx, name, "Source", []interface{}{want})
+	call, err := client.StartCall(ctx, name, "Source", []interface{}{want})
 	if err != nil {
 		if !verror.Is(err, verror.Timeout.ID) && !verror.Is(err, verror.BadProtocol.ID) {
 			t.Fatalf("verror should be a timeout or badprotocol, not %s: stack %s",
@@ -394,7 +397,7 @@
 	defer fn()
 
 	ctx := r.NewContext()
-	call, err := r.Client().StartCall(ctx, name, "Sink", nil)
+	call, err := client.StartCall(ctx, name, "Sink", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -432,7 +435,7 @@
 	defer fn()
 	name := "noservers"
 	ctx, _ := context.WithTimeout(r.NewContext(), 300*time.Millisecond)
-	call, verr := r.Client().StartCall(ctx, name, "Sleep", nil)
+	call, verr := client.StartCall(ctx, name, "Sleep", nil)
 	if verr != nil {
 		testForVerror(t, verr, verror.Timeout, verror.BadProtocol, verror.NoExist)
 		return
@@ -447,7 +450,7 @@
 
 	// If there is no mount table, then we'll get a NoServers error message.
 	ctx, _ := context.WithTimeout(r.NewContext(), 300*time.Millisecond)
-	_, verr := r.Client().StartCall(ctx, name, "Sleep", nil)
+	_, verr := client.StartCall(ctx, name, "Sleep", nil)
 	testForVerror(t, verr, verror.NoServers)
 }
 
diff --git a/runtimes/google/ipc/default_authorizer.go b/runtimes/google/ipc/default_authorizer.go
index 98315fc..d37b4ec 100644
--- a/runtimes/google/ipc/default_authorizer.go
+++ b/runtimes/google/ipc/default_authorizer.go
@@ -37,5 +37,5 @@
 	// breaking encapsulation as the String() method is hidden from the public API
 	// and is only meant for debugging purposes. Should we make the 'String' method
 	// public?
-	return fmt.Errorf("all valid blessings for this request: %v (out of %v) are disallowed by the policy", remoteForContext, remote)
+	return fmt.Errorf("all valid blessings for this request: %v (out of %v) are disallowed by the policy %v (out of %v)", remoteForContext, remote, localForContext, ctx.LocalBlessings())
 }
diff --git a/runtimes/google/ipc/simple_test.go b/runtimes/google/ipc/simple_test.go
index 5f71703..986678b 100644
--- a/runtimes/google/ipc/simple_test.go
+++ b/runtimes/google/ipc/simple_test.go
@@ -5,6 +5,7 @@
 	"testing"
 	"time"
 
+	"v.io/core/veyron2"
 	"v.io/core/veyron2/ipc"
 	verror "v.io/core/veyron2/verror2"
 )
@@ -69,7 +70,7 @@
 	name, fn := initServer(t, r)
 	defer fn()
 
-	client := r.Client()
+	client := veyron2.GetClient(r.NewContext())
 	call, err := client.StartCall(r.NewContext(), name, "Ping", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
@@ -91,7 +92,7 @@
 
 	ctx := r.NewContext()
 	inc := 1
-	call, err := r.Client().StartCall(ctx, name, "Inc", []interface{}{inc})
+	call, err := veyron2.GetClient(r.NewContext()).StartCall(ctx, name, "Inc", []interface{}{inc})
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/runtimes/google/naming/namespace/all_test.go b/runtimes/google/naming/namespace/all_test.go
index debb6d9..b63b54d 100644
--- a/runtimes/google/naming/namespace/all_test.go
+++ b/runtimes/google/naming/namespace/all_test.go
@@ -28,21 +28,22 @@
 	testutil.Init()
 }
 
-func createRuntimes(t *testing.T) (sr, r veyron2.Runtime, cleanup func()) {
-	var err error
+func createRuntimes(t *testing.T) (sc, c *context.T, cleanup func()) {
 	// Create a runtime for the server.
-	sr, err = rt.New()
+	sr, err := rt.New()
 	if err != nil {
 		t.Fatalf("Could not initialize runtime: %v", err)
 	}
+	sc = sr.NewContext()
 
 	// We use a different runtime for the client side.
-	r, err = rt.New()
+	r, err := rt.New()
 	if err != nil {
 		t.Fatalf("Could not initialize runtime: %v", err)
 	}
+	c = r.NewContext()
 
-	return sr, r, func() {
+	return sc, c, func() {
 		sr.Cleanup()
 		r.Cleanup()
 	}
@@ -75,9 +76,9 @@
 	}
 }
 
-func doGlob(t *testing.T, r veyron2.Runtime, ns naming.Namespace, pattern string, limit int) []string {
+func doGlob(t *testing.T, ctx *context.T, ns naming.Namespace, pattern string, limit int) []string {
 	var replies []string
-	rc, err := ns.Glob(r.NewContext(), pattern)
+	rc, err := ns.Glob(ctx, pattern)
 	if err != nil {
 		boom(t, "Glob(%s): %s", pattern, err)
 	}
@@ -124,9 +125,8 @@
 	return &testServer{suffix}, allowEveryoneAuthorizer{}, nil
 }
 
-func knockKnock(t *testing.T, runtime veyron2.Runtime, name string) {
-	client := runtime.Client()
-	ctx := runtime.NewContext()
+func knockKnock(t *testing.T, ctx *context.T, name string) {
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "KnockKnock", nil)
 	if err != nil {
 		boom(t, "StartCall failed: %s", err)
@@ -148,20 +148,20 @@
 	compare(t, fname, name, servers, want)
 }
 
-func testResolveToMountTable(t *testing.T, r veyron2.Runtime, ns naming.Namespace, name string, want ...string) {
-	doResolveTest(t, "ResolveToMountTable", ns.ResolveToMountTable, r.NewContext(), name, want)
+func testResolveToMountTable(t *testing.T, ctx *context.T, ns naming.Namespace, name string, want ...string) {
+	doResolveTest(t, "ResolveToMountTable", ns.ResolveToMountTable, ctx, name, want)
 }
 
-func testResolveToMountTableWithPattern(t *testing.T, r veyron2.Runtime, ns naming.Namespace, name string, pattern naming.ResolveOpt, want ...string) {
-	doResolveTest(t, "ResolveToMountTable", ns.ResolveToMountTable, r.NewContext(), name, want, pattern)
+func testResolveToMountTableWithPattern(t *testing.T, ctx *context.T, ns naming.Namespace, name string, pattern naming.ResolveOpt, want ...string) {
+	doResolveTest(t, "ResolveToMountTable", ns.ResolveToMountTable, ctx, name, want, pattern)
 }
 
-func testResolve(t *testing.T, r veyron2.Runtime, ns naming.Namespace, name string, want ...string) {
-	doResolveTest(t, "Resolve", ns.Resolve, r.NewContext(), name, want)
+func testResolve(t *testing.T, ctx *context.T, ns naming.Namespace, name string, want ...string) {
+	doResolveTest(t, "Resolve", ns.Resolve, ctx, name, want)
 }
 
-func testResolveWithPattern(t *testing.T, r veyron2.Runtime, ns naming.Namespace, name string, pattern naming.ResolveOpt, want ...string) {
-	doResolveTest(t, "Resolve", ns.Resolve, r.NewContext(), name, want, pattern)
+func testResolveWithPattern(t *testing.T, ctx *context.T, ns naming.Namespace, name string, pattern naming.ResolveOpt, want ...string) {
+	doResolveTest(t, "Resolve", ns.Resolve, ctx, name, want, pattern)
 }
 
 type serverEntry struct {
@@ -171,20 +171,20 @@
 	name       string
 }
 
-func runServer(t *testing.T, sr veyron2.Runtime, disp ipc.Dispatcher, mountPoint string) *serverEntry {
-	return run(t, sr, disp, mountPoint, false)
+func runServer(t *testing.T, ctx *context.T, disp ipc.Dispatcher, mountPoint string) *serverEntry {
+	return run(t, ctx, disp, mountPoint, false)
 }
 
-func runMT(t *testing.T, sr veyron2.Runtime, mountPoint string) *serverEntry {
+func runMT(t *testing.T, ctx *context.T, mountPoint string) *serverEntry {
 	mt, err := service.NewMountTable("")
 	if err != nil {
 		boom(t, "NewMountTable returned error: %v", err)
 	}
-	return run(t, sr, mt, mountPoint, true)
+	return run(t, ctx, mt, mountPoint, true)
 }
 
-func run(t *testing.T, sr veyron2.Runtime, disp ipc.Dispatcher, mountPoint string, mt bool) *serverEntry {
-	s, err := sr.NewServer(options.ServesMountTable(mt))
+func run(t *testing.T, ctx *context.T, disp ipc.Dispatcher, mountPoint string, mt bool) *serverEntry {
+	s, err := veyron2.NewServer(ctx, options.ServesMountTable(mt))
 	if err != nil {
 		boom(t, "r.NewServer: %s", err)
 	}
@@ -216,14 +216,14 @@
 
 // runMountTables creates a root mountable with some mount tables mounted
 // in it: mt{1,2,3,4,5}
-func runMountTables(t *testing.T, r veyron2.Runtime) (*serverEntry, map[string]*serverEntry) {
-	root := runMT(t, r, "")
-	r.Namespace().SetRoots(root.name)
+func runMountTables(t *testing.T, ctx *context.T) (*serverEntry, map[string]*serverEntry) {
+	root := runMT(t, ctx, "")
+	veyron2.GetNamespace(ctx).SetRoots(root.name)
 	t.Logf("mountTable %q -> %s", root.mountPoint, root.endpoint)
 
 	mps := make(map[string]*serverEntry)
 	for _, mp := range []string{mt1MP, mt2MP, mt3MP, mt4MP, mt5MP} {
-		m := runMT(t, r, mp)
+		m := runMT(t, ctx, mp)
 		t.Logf("mountTable %q -> %s", mp, m.endpoint)
 		mps[mp] = m
 	}
@@ -235,13 +235,13 @@
 // /mt1, /mt2, /mt3, /mt4, /mt5, /joke1, /joke2, /joke3.
 // That is, mt1 is a mount table mounted in the root mount table,
 // joke1 is a server mounted in the root mount table.
-func createNamespace(t *testing.T, r veyron2.Runtime) (*serverEntry, map[string]*serverEntry, map[string]*serverEntry, func()) {
-	root, mts := runMountTables(t, r)
+func createNamespace(t *testing.T, ctx *context.T) (*serverEntry, map[string]*serverEntry, map[string]*serverEntry, func()) {
+	root, mts := runMountTables(t, ctx)
 	jokes := make(map[string]*serverEntry)
 	// Let's run some non-mount table services.
 	for _, j := range []string{j1MP, j2MP, j3MP} {
 		disp := &dispatcher{}
-		jokes[j] = runServer(t, r, disp, j)
+		jokes[j] = runServer(t, ctx, disp, j)
 	}
 	return root, mts, jokes, func() {
 		for _, s := range jokes {
@@ -257,17 +257,17 @@
 // runNestedMountTables creates some nested mount tables in the hierarchy
 // created by createNamespace as follows:
 // /mt4/foo, /mt4/foo/bar and /mt4/baz where foo, bar and baz are mount tables.
-func runNestedMountTables(t *testing.T, r veyron2.Runtime, mts map[string]*serverEntry) {
-	ns, ctx := r.Namespace(), r.NewContext()
+func runNestedMountTables(t *testing.T, ctx *context.T, mts map[string]*serverEntry) {
+	ns := veyron2.GetNamespace(ctx)
 	// Set up some nested mounts and verify resolution.
 	for _, m := range []string{"mt4/foo", "mt4/foo/bar"} {
-		mts[m] = runMT(t, r, m)
+		mts[m] = runMT(t, ctx, m)
 	}
 
 	// Use a global name for a mount, rather than a relative one.
 	// We directly mount baz into the mt4/foo mount table.
 	globalMP := naming.JoinAddressName(mts["mt4/foo"].name, "baz")
-	mts["baz"] = runMT(t, r, "baz")
+	mts["baz"] = runMT(t, ctx, "baz")
 	if err := ns.Mount(ctx, globalMP, mts["baz"].name, ttl); err != nil {
 		boom(t, "Failed to Mount %s: %s", globalMP, err)
 	}
@@ -276,52 +276,52 @@
 // TestNamespaceCommon tests common use of the Namespace library
 // against a root mount table and some mount tables mounted on it.
 func TestNamespaceCommon(t *testing.T) {
-	_, r, cleanup := createRuntimes(t)
+	_, c, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	root, mts, jokes, stopper := createNamespace(t, r)
+	root, mts, jokes, stopper := createNamespace(t, c)
 	defer stopper()
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 
 	// All of the initial mounts are served by the root mounttable
 	// and hence ResolveToMountTable should return the root mountable
 	// as the address portion of the terminal name for those mounttables.
-	testResolveToMountTable(t, r, ns, "", root.name)
+	testResolveToMountTable(t, c, ns, "", root.name)
 	for _, m := range []string{mt2MP, mt3MP, mt5MP} {
 		rootMT := naming.Join(root.name, m)
 		// All of these mount tables are hosted by the root mount table
-		testResolveToMountTable(t, r, ns, m, rootMT)
+		testResolveToMountTable(t, c, ns, m, rootMT)
 
 		// The server registered for each mount point is a mount table
-		testResolve(t, r, ns, m, mts[m].name)
+		testResolve(t, c, ns, m, mts[m].name)
 
 		// ResolveToMountTable will walk through to the sub MountTables
 		mtbar := naming.Join(m, "bar")
 		subMT := naming.Join(mts[m].name, "bar")
-		testResolveToMountTable(t, r, ns, mtbar, subMT)
+		testResolveToMountTable(t, c, ns, mtbar, subMT)
 	}
 
 	for _, j := range []string{j1MP, j2MP, j3MP} {
-		testResolve(t, r, ns, j, jokes[j].name)
+		testResolve(t, c, ns, j, jokes[j].name)
 	}
 }
 
 // TestNamespaceDetails tests more detailed use of the Namespace library,
 // including the intricacies of // meaning and placement.
 func TestNamespaceDetails(t *testing.T) {
-	sr, r, cleanup := createRuntimes(t)
+	sc, c, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	root, mts, _, stopper := createNamespace(t, sr)
+	root, mts, _, stopper := createNamespace(t, sc)
 	defer stopper()
 
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 	ns.SetRoots(root.name)
 
 	// /mt2 is not an endpoint. Thus, the example below will fail.
 	mt3Server := mts[mt3MP].name
 	mt2a := "/mt2/a"
-	if err := ns.Mount(r.NewContext(), mt2a, mt3Server, ttl); verror.Is(err, naming.ErrNoSuchName.ID) {
+	if err := ns.Mount(c, mt2a, mt3Server, ttl); verror.Is(err, naming.ErrNoSuchName.ID) {
 		boom(t, "Successfully mounted %s - expected an err %v, not %v", mt2a, naming.ErrNoSuchName, err)
 	}
 
@@ -330,15 +330,15 @@
 	// the lower level mount table, if the name doesn't exist we'll create
 	// a new name for it.
 	mt2a = "mt2/a"
-	if err := ns.Mount(r.NewContext(), mt2a, mt3Server, ttl); err != nil {
+	if err := ns.Mount(c, mt2a, mt3Server, ttl); err != nil {
 		boom(t, "Failed to Mount %s: %s", mt2a, err)
 	}
 
 	mt2mt := naming.Join(mts[mt2MP].name, "a")
 	// The mt2/a is served by the mt2 mount table
-	testResolveToMountTable(t, r, ns, mt2a, mt2mt)
+	testResolveToMountTable(t, c, ns, mt2a, mt2mt)
 	// The server for mt2a is mt3server from the second mount above.
-	testResolve(t, r, ns, mt2a, mt3Server)
+	testResolve(t, c, ns, mt2a, mt3Server)
 
 	// Add two more mounts. The // should be stripped off of the
 	// second.
@@ -346,7 +346,7 @@
 		{"mt2", mts[mt4MP].name},
 		{"mt2//", mts[mt5MP].name},
 	} {
-		if err := ns.Mount(r.NewContext(), mp.name, mp.server, ttl, naming.ServesMountTableOpt(true)); err != nil {
+		if err := ns.Mount(c, mp.name, mp.server, ttl, naming.ServesMountTableOpt(true)); err != nil {
 			boom(t, "Failed to Mount %s: %s", mp.name, err)
 		}
 	}
@@ -355,71 +355,71 @@
 		naming.JoinAddressName(mts[mt5MP].name, "a")}
 	names = append(names, naming.JoinAddressName(mts[mt2MP].name, "a"))
 	// We now have 3 mount tables prepared to serve mt2/a
-	testResolveToMountTable(t, r, ns, "mt2/a", names...)
+	testResolveToMountTable(t, c, ns, "mt2/a", names...)
 	names = []string{mts[mt4MP].name, mts[mt5MP].name}
 	names = append(names, mts[mt2MP].name)
-	testResolve(t, r, ns, "mt2", names...)
+	testResolve(t, c, ns, "mt2", names...)
 }
 
 // TestNestedMounts tests some more deeply nested mounts
 func TestNestedMounts(t *testing.T) {
-	sr, r, cleanup := createRuntimes(t)
+	sc, c, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	root, mts, _, stopper := createNamespace(t, sr)
-	runNestedMountTables(t, sr, mts)
+	root, mts, _, stopper := createNamespace(t, sc)
+	runNestedMountTables(t, sc, mts)
 	defer stopper()
 
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 	ns.SetRoots(root.name)
 
 	// Set up some nested mounts and verify resolution.
 	for _, m := range []string{"mt4/foo", "mt4/foo/bar"} {
-		testResolve(t, r, ns, m, mts[m].name)
+		testResolve(t, c, ns, m, mts[m].name)
 	}
 
-	testResolveToMountTable(t, r, ns, "mt4/foo",
+	testResolveToMountTable(t, c, ns, "mt4/foo",
 		naming.JoinAddressName(mts[mt4MP].name, "foo"))
-	testResolveToMountTable(t, r, ns, "mt4/foo/bar",
+	testResolveToMountTable(t, c, ns, "mt4/foo/bar",
 		naming.JoinAddressName(mts["mt4/foo"].name, "bar"))
-	testResolveToMountTable(t, r, ns, "mt4/foo/baz",
+	testResolveToMountTable(t, c, ns, "mt4/foo/baz",
 		naming.JoinAddressName(mts["mt4/foo"].name, "baz"))
 }
 
 // TestServers tests invoking RPCs on simple servers
 func TestServers(t *testing.T) {
-	sr, r, cleanup := createRuntimes(t)
+	sc, c, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	root, mts, jokes, stopper := createNamespace(t, sr)
+	root, mts, jokes, stopper := createNamespace(t, sc)
 	defer stopper()
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 	ns.SetRoots(root.name)
 
 	// Let's run some non-mount table services
 	for _, j := range []string{j1MP, j2MP, j3MP} {
-		testResolve(t, r, ns, j, jokes[j].name)
-		knockKnock(t, r, j)
+		testResolve(t, c, ns, j, jokes[j].name)
+		knockKnock(t, c, j)
 		globalName := naming.JoinAddressName(mts["mt4"].name, j)
 		disp := &dispatcher{}
 		gj := "g_" + j
-		jokes[gj] = runServer(t, r, disp, globalName)
-		testResolve(t, r, ns, "mt4/"+j, jokes[gj].name)
-		knockKnock(t, r, "mt4/"+j)
-		testResolveToMountTable(t, r, ns, "mt4/"+j, globalName)
-		testResolveToMountTable(t, r, ns, "mt4/"+j+"/garbage", globalName+"/garbage")
+		jokes[gj] = runServer(t, c, disp, globalName)
+		testResolve(t, c, ns, "mt4/"+j, jokes[gj].name)
+		knockKnock(t, c, "mt4/"+j)
+		testResolveToMountTable(t, c, ns, "mt4/"+j, globalName)
+		testResolveToMountTable(t, c, ns, "mt4/"+j+"/garbage", globalName+"/garbage")
 	}
 }
 
 // TestGlob tests some glob patterns.
 func TestGlob(t *testing.T) {
-	sr, r, cleanup := createRuntimes(t)
+	sc, c, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	root, mts, _, stopper := createNamespace(t, sr)
-	runNestedMountTables(t, sr, mts)
+	root, mts, _, stopper := createNamespace(t, sc)
+	runNestedMountTables(t, sc, mts)
 	defer stopper()
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 	ns.SetRoots(root.name)
 
 	tln := []string{"baz", "mt1", "mt2", "mt3", "mt4", "mt5", "joke1", "joke2", "joke3"}
@@ -449,10 +449,10 @@
 		{"mt4/foo/baz", []string{"mt4/foo/baz"}},
 	}
 	for _, test := range globTests {
-		out := doGlob(t, r, ns, test.pattern, 0)
+		out := doGlob(t, c, ns, test.pattern, 0)
 		compare(t, "Glob", test.pattern, out, test.expected)
 		// Do the same with a full rooted name.
-		out = doGlob(t, r, ns, naming.JoinAddressName(root.name, test.pattern), 0)
+		out = doGlob(t, c, ns, naming.JoinAddressName(root.name, test.pattern), 0)
 		var expectedWithRoot []string
 		for _, s := range test.expected {
 			expectedWithRoot = append(expectedWithRoot, naming.JoinAddressName(root.name, s))
@@ -484,19 +484,19 @@
 
 // TestGlobEarlyStop tests that Glob doesn't query terminal servers with finished patterns.
 func TestGlobEarlyStop(t *testing.T) {
-	sr, r, cleanup := createRuntimes(t)
+	sc, c, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	root, mts, _, stopper := createNamespace(t, sr)
-	runNestedMountTables(t, sr, mts)
+	root, mts, _, stopper := createNamespace(t, sc)
+	runNestedMountTables(t, sc, mts)
 	defer stopper()
 
 	globServer := &GlobbableServer{}
 	name := naming.JoinAddressName(mts["mt4/foo/bar"].name, "glob")
-	runningGlobServer := runServer(t, r, testutil.LeafDispatcher(globServer, nil), name)
+	runningGlobServer := runServer(t, c, testutil.LeafDispatcher(globServer, nil), name)
 	defer runningGlobServer.server.Stop()
 
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 	ns.SetRoots(root.name)
 
 	tests := []struct {
@@ -515,7 +515,7 @@
 	}
 	// Test allowing the tests to descend into leaves.
 	for _, test := range tests {
-		out := doGlob(t, r, ns, test.pattern, 0)
+		out := doGlob(t, c, ns, test.pattern, 0)
 		compare(t, "Glob", test.pattern, out, test.expected)
 		if calls := globServer.GetAndResetCount(); calls != test.expectedCalls {
 			boom(t, "Wrong number of Glob calls to terminal server got: %d want: %d.", calls, test.expectedCalls)
@@ -524,61 +524,61 @@
 }
 
 func TestCycles(t *testing.T) {
-	sr, r, cleanup := createRuntimes(t)
+	sc, c, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	root, _, _, stopper := createNamespace(t, sr)
+	root, _, _, stopper := createNamespace(t, sc)
 	defer stopper()
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 	ns.SetRoots(root.name)
 
-	c1 := runMT(t, r, "c1")
-	c2 := runMT(t, r, "c2")
-	c3 := runMT(t, r, "c3")
+	c1 := runMT(t, c, "c1")
+	c2 := runMT(t, c, "c2")
+	c3 := runMT(t, c, "c3")
 	defer c1.server.Stop()
 	defer c2.server.Stop()
 	defer c3.server.Stop()
 
 	m := "c1/c2"
-	if err := ns.Mount(r.NewContext(), m, c1.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(c, m, c1.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
 		boom(t, "Failed to Mount %s: %s", "c1/c2", err)
 	}
 
 	m = "c1/c2/c3"
-	if err := ns.Mount(r.NewContext(), m, c3.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(c, m, c3.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
 		boom(t, "Failed to Mount %s: %s", m, err)
 	}
 
 	m = "c1/c3/c4"
-	if err := ns.Mount(r.NewContext(), m, c1.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(c, m, c1.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
 		boom(t, "Failed to Mount %s: %s", m, err)
 	}
 
 	// Since c1 was mounted with the Serve call, it will have both the tcp and ws endpoints.
-	testResolve(t, r, ns, "c1", c1.name)
-	testResolve(t, r, ns, "c1/c2", c1.name)
-	testResolve(t, r, ns, "c1/c3", c3.name)
-	testResolve(t, r, ns, "c1/c3/c4", c1.name)
-	testResolve(t, r, ns, "c1/c3/c4/c3/c4", c1.name)
+	testResolve(t, c, ns, "c1", c1.name)
+	testResolve(t, c, ns, "c1/c2", c1.name)
+	testResolve(t, c, ns, "c1/c3", c3.name)
+	testResolve(t, c, ns, "c1/c3/c4", c1.name)
+	testResolve(t, c, ns, "c1/c3/c4/c3/c4", c1.name)
 	cycle := "c3/c4"
 	for i := 0; i < 40; i++ {
 		cycle += "/c3/c4"
 	}
-	if _, err := ns.Resolve(r.NewContext(), "c1/"+cycle); !verror.Is(err, naming.ErrResolutionDepthExceeded.ID) {
+	if _, err := ns.Resolve(c, "c1/"+cycle); !verror.Is(err, naming.ErrResolutionDepthExceeded.ID) {
 		boom(t, "Failed to detect cycle")
 	}
 
 	// Perform the glob with a response length limit.
-	doGlob(t, r, ns, "c1/...", 1000)
+	doGlob(t, c, ns, "c1/...", 1000)
 }
 
 // TestGoroutineLeaks tests for leaking goroutines - we have many:-(
 func TestGoroutineLeaks(t *testing.T) {
 	t.Skip()
-	sr, _, cleanup := createRuntimes(t)
+	sc, _, cleanup := createRuntimes(t)
 	defer cleanup()
 
-	_, _, _, stopper := createNamespace(t, sr)
+	_, _, _, stopper := createNamespace(t, sc)
 	defer func() {
 		vlog.Infof("%d goroutines:", runtime.NumGoroutine())
 	}()
@@ -607,7 +607,7 @@
 }
 
 func TestRootBlessing(t *testing.T) {
-	r, cr, cleanup := createRuntimes(t)
+	c, cc, cleanup := createRuntimes(t)
 	defer cleanup()
 
 	proot, err := vsecurity.NewPrincipal()
@@ -620,31 +620,32 @@
 	}
 	proot.BlessingStore().SetDefault(b)
 
-	bless(proot, r.Principal(), "server")
-	bless(proot, cr.Principal(), "client")
+	sprincipal := veyron2.GetPrincipal(c)
+	cprincipal := veyron2.GetPrincipal(cc)
+	bless(proot, sprincipal, "server")
+	bless(proot, cprincipal, "client")
+	cprincipal.AddToRoots(proot.BlessingStore().Default())
+	sprincipal.AddToRoots(proot.BlessingStore().Default())
 
-	cr.Principal().AddToRoots(proot.BlessingStore().Default())
-	r.Principal().AddToRoots(proot.BlessingStore().Default())
-
-	root, mts, _, stopper := createNamespace(t, r)
+	root, mts, _, stopper := createNamespace(t, c)
 	defer stopper()
-	ns := r.Namespace()
+	ns := veyron2.GetNamespace(c)
 
 	name := naming.Join(root.name, mt2MP)
 	// First check with a non-matching blessing pattern.
-	_, err = ns.Resolve(r.NewContext(), name, naming.RootBlessingPatternOpt("root/foobar"))
+	_, err = ns.Resolve(c, name, naming.RootBlessingPatternOpt("root/foobar"))
 	if !verror.Is(err, verror.NotTrusted.ID) {
 		t.Errorf("Resolve expected NotTrusted error, got %v", err)
 	}
-	_, err = ns.ResolveToMountTable(r.NewContext(), name, naming.RootBlessingPatternOpt("root/foobar"))
+	_, err = ns.ResolveToMountTable(c, name, naming.RootBlessingPatternOpt("root/foobar"))
 	if !verror.Is(err, verror.NotTrusted.ID) {
 		t.Errorf("ResolveToMountTable expected NotTrusted error, got %v", err)
 	}
 
 	// Now check a matching pattern.
-	testResolveWithPattern(t, r, ns, name, naming.RootBlessingPatternOpt("root/server"), mts[mt2MP].name)
-	testResolveToMountTableWithPattern(t, r, ns, name, naming.RootBlessingPatternOpt("root/server"), name)
+	testResolveWithPattern(t, c, ns, name, naming.RootBlessingPatternOpt("root/server"), mts[mt2MP].name)
+	testResolveToMountTableWithPattern(t, c, ns, name, naming.RootBlessingPatternOpt("root/server"), name)
 
 	// After successful lookup it should be cached, so the pattern doesn't matter.
-	testResolveWithPattern(t, r, ns, name, naming.RootBlessingPatternOpt("root/foobar"), mts[mt2MP].name)
+	testResolveWithPattern(t, c, ns, name, naming.RootBlessingPatternOpt("root/foobar"), mts[mt2MP].name)
 }
diff --git a/runtimes/google/naming/namespace/glob.go b/runtimes/google/naming/namespace/glob.go
index dd287c3..40a3951 100644
--- a/runtimes/google/naming/namespace/glob.go
+++ b/runtimes/google/naming/namespace/glob.go
@@ -31,7 +31,7 @@
 //   recursive true to continue below the matched pattern
 func (ns *namespace) globAtServer(ctx *context.T, qe *queuedEntry, pattern *glob.Glob, l *list.List) error {
 	server := qe.me
-	client := veyron2.RuntimeFromContext(ctx).Client()
+	client := veyron2.GetClient(ctx)
 	pstr := pattern.String()
 	vlog.VI(2).Infof("globAtServer(%v, %v)", *server, pstr)
 
diff --git a/runtimes/google/naming/namespace/mount.go b/runtimes/google/naming/namespace/mount.go
index fe85b19..7af3cf2 100644
--- a/runtimes/google/naming/namespace/mount.go
+++ b/runtimes/google/naming/namespace/mount.go
@@ -120,7 +120,7 @@
 		}
 	}
 
-	client := veyron2.RuntimeFromContext(ctx).Client()
+	client := veyron2.GetClient(ctx)
 
 	// Mount the server in all the returned mount tables.
 	f := func(ctx *context.T, mt, id string) status {
@@ -134,7 +134,7 @@
 func (ns *namespace) Unmount(ctx *context.T, name, server string) error {
 	defer vlog.LogCall()()
 	// Unmount the server from all the mount tables.
-	client := veyron2.RuntimeFromContext(ctx).Client()
+	client := veyron2.GetClient(ctx)
 	f := func(context *context.T, mt, id string) status {
 		return unmountFromMountTable(ctx, client, mt, server, id)
 	}
diff --git a/runtimes/google/naming/namespace/resolve.go b/runtimes/google/naming/namespace/resolve.go
index 28bfeae..61631b7 100644
--- a/runtimes/google/naming/namespace/resolve.go
+++ b/runtimes/google/naming/namespace/resolve.go
@@ -84,7 +84,7 @@
 		return nil, verror.Make(naming.ErrNoSuchName, ctx, name)
 	}
 	pattern := getRootPattern(opts)
-	client := veyron2.RuntimeFromContext(ctx).Client()
+	client := veyron2.GetClient(ctx)
 	var callOpts []ipc.CallOpt
 	for _, opt := range opts {
 		if callOpt, ok := opt.(ipc.CallOpt); ok {
@@ -141,7 +141,7 @@
 		return nil, verror.Make(naming.ErrNoMountTable, ctx)
 	}
 	pattern := getRootPattern(opts)
-	client := veyron2.RuntimeFromContext(ctx).Client()
+	client := veyron2.GetClient(ctx)
 	last := e
 	for remaining := ns.maxResolveDepth; remaining > 0; remaining-- {
 		vlog.VI(2).Infof("ResolveToMountTableX(%s) loop %v", name, e)
diff --git a/runtimes/google/rt/ipc_test.go b/runtimes/google/rt/ipc_test.go
index 37b6b9a..7cab98e 100644
--- a/runtimes/google/rt/ipc_test.go
+++ b/runtimes/google/rt/ipc_test.go
@@ -7,6 +7,7 @@
 	"time"
 
 	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/rt"
@@ -85,8 +86,8 @@
 	return newCaveat(tpc)
 }
 
-func startServer(runtime veyron2.Runtime, s interface{}) (ipc.Server, string, error) {
-	server, err := runtime.NewServer()
+func startServer(ctx *context.T, s interface{}) (ipc.Server, string, error) {
+	server, err := veyron2.NewServer(ctx)
 	if err != nil {
 		return nil, "", err
 	}
@@ -160,7 +161,7 @@
 		}
 	}
 	// Start the server process.
-	server, serverObjectName, err := startServer(serverRT, testService{})
+	server, serverObjectName, err := startServer(serverRT.NewContext(), testService{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -168,21 +169,19 @@
 
 	// Let it rip!
 	for _, test := range tests {
-		// Create a new client per test so as to not re-use established authenticated VCs.
 		// TODO(ashankar,suharshs): Once blessings are exchanged "per-RPC", one client for all cases will suffice.
 		// Also, we need server to lameduck VCs when server.BlessingStore().Default() has changed
 		// for one client to be sufficient.
-		client, err := clientRT.NewClient()
+		ctx, client, err := veyron2.SetNewClient(clientRT.NewContext())
 		if err != nil {
-			t.Errorf("clientRT.NewClient failed: %v", err)
-			continue
+			panic(err)
 		}
 		if err := pserver.BlessingStore().SetDefault(test.server); err != nil {
 			t.Errorf("pserver.SetDefault(%v) failed: %v", test.server, err)
 			continue
 		}
 		var gotClient []string
-		if call, err := client.StartCall(clientRT.NewContext(), serverObjectName, "EchoBlessings", nil); err != nil {
+		if call, err := client.StartCall(ctx, serverObjectName, "EchoBlessings", nil); err != nil {
 			t.Errorf("client.StartCall failed: %v", err)
 		} else if err = call.Finish(&gotClient); err != nil {
 			t.Errorf("call.Finish failed: %v", err)
@@ -191,7 +190,6 @@
 		} else if gotServer, _ := call.RemoteBlessings(); !reflect.DeepEqual(gotServer, test.wantServer) {
 			t.Errorf("%v: Got %v, want %v for server blessings", test.server, gotServer, test.wantClient)
 		}
-		client.Close()
 	}
 }
 
@@ -208,13 +206,15 @@
 		root                             = tsecurity.NewIDProvider("root")
 	)
 
+	clientCtx, serverCtx := clientRT.NewContext(), serverRT.NewContext()
+
 	// Start the server and discharge server.
-	server, serverName, err := startServer(serverRT, &testService{})
+	server, serverName, err := startServer(serverCtx, &testService{})
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer server.Stop()
-	dischargeServer, dischargeServerName, err := startServer(dischargerRT, &dischargeService{})
+	dischargeServer, dischargeServerName, err := startServer(dischargerRT.NewContext(), &dischargeService{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -228,13 +228,6 @@
 		t.Fatal(err)
 	}
 
-	// Create a new client.
-	client, err := clientRT.NewClient()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer client.Close()
-
 	// Setup up the client's blessing store so that it can talk to the server.
 	rootClient := b(root.NewBlessings(pclient, "client"))
 	if _, err := pclient.BlessingStore().Set(nil, security.AllPrincipals); err != nil {
@@ -252,7 +245,13 @@
 	wantClient := []string{"root/client"}
 	wantServer := []string{"root/server"}
 	var gotClient []string
-	if call, err := client.StartCall(clientRT.NewContext(), serverName, "EchoBlessings", nil); err != nil {
+
+	// Create a new client.
+	clientCtx, client, err := veyron2.SetNewClient(clientCtx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if call, err := client.StartCall(clientCtx, serverName, "EchoBlessings", nil); err != nil {
 		t.Errorf("client.StartCall failed: %v", err)
 	} else if err = call.Finish(&gotClient); err != nil {
 		t.Errorf("call.Finish failed: %v", err)
@@ -264,16 +263,16 @@
 
 	// Test that the client fails to talk to server that does not present appropriate discharges.
 	// Setup a new client so that there are no cached VCs.
-	if client, err = clientRT.NewClient(); err != nil {
+	clientCtx, client, err = veyron2.SetNewClient(clientCtx)
+	if err != nil {
 		t.Fatal(err)
 	}
-	defer client.Close()
 
 	rootServerInvalidTPCaveat := b(root.NewBlessings(pserver, "server", mkThirdPartyCaveat(pdischarger.PublicKey(), dischargeServerName, mkCaveat(security.ExpiryCaveat(time.Now().Add(-1*time.Second))))))
 	if err := pserver.BlessingStore().SetDefault(rootServerInvalidTPCaveat); err != nil {
 		t.Fatal(err)
 	}
-	if call, err := client.StartCall(clientRT.NewContext(), serverName, "EchoBlessings", nil); verror.Is(err, verror.NoAccess) {
+	if call, err := client.StartCall(clientCtx, serverName, "EchoBlessings", nil); verror.Is(err, verror.NoAccess) {
 		remoteBlessings, _ := call.RemoteBlessings()
 		t.Errorf("client.StartCall passed unexpectedly with remote end authenticated as: %v", remoteBlessings)
 	}
diff --git a/runtimes/google/rt/runtimex.go b/runtimes/google/rt/runtimex.go
index 426d0cf..08a7cdc 100644
--- a/runtimes/google/rt/runtimex.go
+++ b/runtimes/google/rt/runtimex.go
@@ -208,6 +208,12 @@
 
 	client, err := iipc.InternalNewClient(sm, ns, otherOpts...)
 	if err == nil {
+		if done := ctx.Done(); done != nil {
+			go func() {
+				<-done
+				client.Close()
+			}()
+		}
 		ctx = SetClient(ctx, client)
 	}
 	return ctx, client, err
diff --git a/runtimes/google/rt/security.go b/runtimes/google/rt/security.go
index 61e63d4..59f5497 100644
--- a/runtimes/google/rt/security.go
+++ b/runtimes/google/rt/security.go
@@ -94,5 +94,5 @@
 }
 
 func (rt *vrt) connectToAgent(fd int) (security.Principal, error) {
-	return agent.NewAgentPrincipal(fd, rt.NewContext())
+	return agent.NewAgentPrincipal(rt.NewContext(), fd)
 }
diff --git a/security/agent/agent_test.go b/security/agent/agent_test.go
index 1069fcf..7236034 100644
--- a/security/agent/agent_test.go
+++ b/security/agent/agent_test.go
@@ -11,20 +11,21 @@
 	"v.io/core/veyron/security/agent"
 	"v.io/core/veyron/security/agent/server"
 
-	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/rt"
 	"v.io/core/veyron2/security"
 	"v.io/core/veyron2/verror2"
 )
 
-func setupAgent(t *testing.T, runtime veyron2.Runtime, p security.Principal) security.Principal {
-	sock, err := server.RunAnonymousAgent(runtime, p)
+func setupAgent(t *testing.T, ctx *context.T, p security.Principal) security.Principal {
+	sock, err := server.RunAnonymousAgent(ctx, p)
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer sock.Close()
+
 	var agentP security.Principal
-	if agentP, err = agent.NewAgentPrincipal(int(sock.Fd()), runtime.NewContext()); err != nil {
+	if agentP, err = agent.NewAgentPrincipal(ctx, int(sock.Fd())); err != nil {
 		t.Fatal(err)
 	}
 	return agentP
@@ -56,7 +57,7 @@
 	var (
 		thirdPartyCaveat, discharge = newThirdPartyCaveatAndDischarge(t)
 		mockP                       = newMockPrincipal()
-		agent                       = setupAgent(t, r, mockP)
+		agent                       = setupAgent(t, r.NewContext(), mockP)
 	)
 	tests := []testInfo{
 		{"BlessSelf", V{"self"}, newBlessing(t, "blessing"), nil},
diff --git a/security/agent/agentd/main.go b/security/agent/agentd/main.go
index 7f4d824..3896545 100644
--- a/security/agent/agentd/main.go
+++ b/security/agent/agentd/main.go
@@ -103,11 +103,11 @@
 
 	// Start running our server.
 	var sock, mgrSock *os.File
-	if sock, err = server.RunAnonymousAgent(runtime, p); err != nil {
+	if sock, err = server.RunAnonymousAgent(ctx, p); err != nil {
 		log.Fatalf("RunAnonymousAgent: %v", err)
 	}
 	if *keypath != "" {
-		if mgrSock, err = server.RunKeyManager(runtime, *keypath, passphrase); err != nil {
+		if mgrSock, err = server.RunKeyManager(ctx, *keypath, passphrase); err != nil {
 			log.Fatalf("RunKeyManager: %v", err)
 		}
 	}
diff --git a/security/agent/client.go b/security/agent/client.go
index 32ab93c..d2574dc 100644
--- a/security/agent/client.go
+++ b/security/agent/client.go
@@ -16,6 +16,7 @@
 	"v.io/core/veyron2/security"
 	"v.io/core/veyron2/vdl/vdlutil"
 	"v.io/core/veyron2/vlog"
+	"v.io/core/veyron2/vtrace"
 )
 
 // FdVarName is the name of the environment variable containing
@@ -28,16 +29,18 @@
 }
 
 type caller struct {
+	ctx    *context.T
 	client ipc.Client
 	name   string
-	ctx    *context.T
 }
 
 func (c *caller) call(name string, results []interface{}, args ...interface{}) (err error) {
 	var call ipc.Call
 	results = append(results, &err)
+
+	ctx, _ := vtrace.SetNewTrace(c.ctx)
 	// VCSecurityNone is safe here since we're using anonymous unix sockets.
-	if call, err = c.client.StartCall(c.ctx, c.name, name, args, options.VCSecurityNone); err == nil {
+	if call, err = c.client.StartCall(ctx, c.name, name, args, options.VCSecurityNone); err == nil {
 		if ierr := call.Finish(results...); ierr != nil {
 			err = ierr
 		}
@@ -56,7 +59,7 @@
 // 'fd' is the socket for connecting to the agent, typically obtained from
 // os.GetEnv(agent.FdVarName).
 // 'ctx' should not have a deadline, and should never be cancelled.
-func NewAgentPrincipal(fd int, ctx *context.T) (security.Principal, error) {
+func NewAgentPrincipal(ctx *context.T, fd int) (security.Principal, error) {
 	f := os.NewFile(uintptr(fd), "agent_client")
 	defer f.Close()
 	conn, err := net.FileConn(f)
diff --git a/security/agent/keymgr/keymgr_test.go b/security/agent/keymgr/keymgr_test.go
index c3d6f15..f9d18b7 100644
--- a/security/agent/keymgr/keymgr_test.go
+++ b/security/agent/keymgr/keymgr_test.go
@@ -12,19 +12,19 @@
 	"v.io/core/veyron/security/agent"
 	"v.io/core/veyron/security/agent/server"
 
-	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/rt"
 	"v.io/core/veyron2/security"
 )
 
-func createAgent(runtime veyron2.Runtime, path string) (*Agent, func(), error) {
+func createAgent(ctx *context.T, path string) (*Agent, func(), error) {
 	var defers []func()
 	cleanup := func() {
 		for _, f := range defers {
 			f()
 		}
 	}
-	sock, err := server.RunKeyManager(runtime, path, nil)
+	sock, err := server.RunKeyManager(ctx, path, nil)
 	var agent *Agent
 	if sock != nil {
 		defers = append(defers, func() { os.RemoveAll(path) })
@@ -45,7 +45,7 @@
 	}
 	defer runtime.Cleanup()
 
-	agent, cleanup, err := createAgent(runtime, "")
+	agent, cleanup, err := createAgent(runtime.NewContext(), "")
 	defer cleanup()
 	if err == nil {
 		t.Fatal(err)
@@ -55,22 +55,22 @@
 	}
 }
 
-func createClient(runtime veyron2.Runtime, deviceAgent *Agent, id []byte) (security.Principal, error) {
+func createClient(ctx *context.T, deviceAgent *Agent, id []byte) (security.Principal, error) {
 	file, err := deviceAgent.NewConnection(id)
 	if err != nil {
 		return nil, err
 	}
 	defer file.Close()
-	return createClient2(runtime, file)
+	return createClient2(ctx, file)
 }
 
-func createClient2(runtime veyron2.Runtime, conn *os.File) (security.Principal, error) {
+func createClient2(ctx *context.T, conn *os.File) (security.Principal, error) {
 	fd, err := syscall.Dup(int(conn.Fd()))
 	if err != nil {
 		return nil, err
 	}
 
-	return agent.NewAgentPrincipal(fd, runtime.NewContext())
+	return agent.NewAgentPrincipal(ctx, fd)
 }
 
 func TestSigning(t *testing.T) {
@@ -79,23 +79,24 @@
 		t.Fatalf("Could not initialize runtime: %s", err)
 	}
 	defer runtime.Cleanup()
+	ctx := runtime.NewContext()
 
 	path, err := ioutil.TempDir("", "agent")
 	if err != nil {
 		t.Fatal(err)
 	}
-	agent, cleanup, err := createAgent(runtime, path)
+	agent, cleanup, err := createAgent(ctx, path)
 	defer cleanup()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	id1, conn1, err := agent.NewPrincipal(runtime.NewContext(), false)
+	id1, conn1, err := agent.NewPrincipal(ctx, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	conn1.Close()
-	id2, conn2, err := agent.NewPrincipal(runtime.NewContext(), false)
+	id2, conn2, err := agent.NewPrincipal(ctx, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -113,11 +114,11 @@
 		t.Errorf("Expected 2 files created, found %d", len(files))
 	}
 
-	a, err := createClient(runtime, agent, id1)
+	a, err := createClient(ctx, agent, id1)
 	if err != nil {
 		t.Fatal(err)
 	}
-	b, err := createClient(runtime, agent, id2)
+	b, err := createClient(ctx, agent, id2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -149,12 +150,13 @@
 		t.Fatalf("Could not initialize runtime: %s", err)
 	}
 	defer runtime.Cleanup()
+	ctx := runtime.NewContext()
 
 	path, err := ioutil.TempDir("", "agent")
 	if err != nil {
 		t.Fatal(err)
 	}
-	agent, cleanup, err := createAgent(runtime, path)
+	agent, cleanup, err := createAgent(ctx, path)
 	defer cleanup()
 	if err != nil {
 		t.Fatal(err)
@@ -177,7 +179,7 @@
 		t.Errorf("Expected 0 files created, found %d", len(files))
 	}
 
-	c, err := createClient2(runtime, conn)
+	c, err := createClient2(ctx, conn)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -189,7 +191,7 @@
 		t.Errorf("Signature a fails verification")
 	}
 
-	c2, err := createClient(runtime, agent, id)
+	c2, err := createClient(ctx, agent, id)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/security/agent/server/server.go b/security/agent/server/server.go
index 28142ec..28569fa 100644
--- a/security/agent/server/server.go
+++ b/security/agent/server/server.go
@@ -18,6 +18,7 @@
 	"v.io/core/veyron/lib/unixfd"
 	vsecurity "v.io/core/veyron/security"
 	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/options"
 	"v.io/core/veyron2/security"
@@ -48,7 +49,7 @@
 	path       string
 	principals map[keyHandle]security.Principal // GUARDED_BY(Mutex)
 	passphrase []byte
-	runtime    veyron2.Runtime
+	ctx        *context.T
 	mu         sync.Mutex
 }
 
@@ -56,12 +57,12 @@
 // anonymous unix domain socket. It will respond to requests
 // using 'principal'.
 // The returned 'client' is typically passed via cmd.ExtraFiles to a child process.
-func RunAnonymousAgent(runtime veyron2.Runtime, principal security.Principal) (client *os.File, err error) {
+func RunAnonymousAgent(ctx *context.T, principal security.Principal) (client *os.File, err error) {
 	local, remote, err := unixfd.Socketpair()
 	if err != nil {
 		return nil, err
 	}
-	if err = startAgent(local, runtime, principal); err != nil {
+	if err = startAgent(ctx, local, principal); err != nil {
 		return nil, err
 	}
 	return remote, err
@@ -71,12 +72,12 @@
 // anonymous unix domain socket. It will persist principals in 'path' using 'passphrase'.
 // Typically only used by the device manager.
 // The returned 'client' is typically passed via cmd.ExtraFiles to a child process.
-func RunKeyManager(runtime veyron2.Runtime, path string, passphrase []byte) (client *os.File, err error) {
+func RunKeyManager(ctx *context.T, path string, passphrase []byte) (client *os.File, err error) {
 	if path == "" {
 		return nil, verror.Make(errStoragePathRequired, nil)
 	}
 
-	mgr := &keymgr{path: path, passphrase: passphrase, principals: make(map[keyHandle]security.Principal), runtime: runtime}
+	mgr := &keymgr{path: path, passphrase: passphrase, principals: make(map[keyHandle]security.Principal), ctx: ctx}
 
 	if err := os.MkdirAll(filepath.Join(mgr.path, "keys"), 0700); err != nil {
 		return nil, err
@@ -129,7 +130,7 @@
 		}
 		conn := dial(addr)
 		if principal != nil && conn != nil {
-			if err := startAgent(conn, a.runtime, principal); err != nil {
+			if err := startAgent(a.ctx, conn, principal); err != nil {
 				vlog.Infof("error starting agent: %v", err)
 			}
 		}
@@ -183,7 +184,7 @@
 	return conn.(*net.UnixConn)
 }
 
-func startAgent(conn *net.UnixConn, runtime veyron2.Runtime, principal security.Principal) error {
+func startAgent(ctx *context.T, conn *net.UnixConn, principal security.Principal) error {
 	agent := &agentd{principal: principal}
 	serverAgent := AgentServer(agent)
 	go func() {
@@ -200,7 +201,7 @@
 				// Also, VCSecurityNone implies that s (ipc.Server) created below does not
 				// authenticate to clients, so runtime.Principal is irrelevant for the agent.
 				// TODO(ribrdb): Shutdown these servers when the connection is closed.
-				s, err := runtime.NewServer(options.VCSecurityNone)
+				s, err := veyron2.NewServer(ctx, options.VCSecurityNone)
 				if err != nil {
 					vlog.Infof("Error creating server: %v", err)
 					ack()
diff --git a/services/mgmt/application/impl/acl_test.go b/services/mgmt/application/impl/acl_test.go
index 9c0d6ab..0efba13 100644
--- a/services/mgmt/application/impl/acl_test.go
+++ b/services/mgmt/application/impl/acl_test.go
@@ -70,7 +70,7 @@
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
 	defer vlog.VI(1).Infof("%v terminating", publishName)
 	defer globalRT.Cleanup()
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	name := naming.JoinAddressName(endpoint, "")
@@ -91,29 +91,30 @@
 }
 
 func TestApplicationUpdateACL(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// setup mock up directory to put state in
 	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
 	defer cleanup()
 
-	selfRT := globalRT
 	otherRT := mgmttest.NewRuntime(t, globalRT)
 	defer otherRT.Cleanup()
+	otherCtx := otherRT.NewContext()
+
 	idp := tsecurity.NewIDProvider("root")
 
-	// By default, selfRT and otherRT will have blessings generated based on the
+	// By default, globalRT and otherRT will have blessings generated based on the
 	// username/machine name running this process. Since these blessings will appear
 	// in ACLs, give them recognizable names.
-	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(globalCtx), "self"); err != nil {
 		t.Fatal(err)
 	}
-	if err := idp.Bless(otherRT.Principal(), "other"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(otherCtx), "other"); err != nil {
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "repo")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "repo")
 	defer os.RemoveAll(crDir)
 
 	// Make server credentials derived from the test harness.
@@ -121,7 +122,8 @@
 	pid := mgmttest.ReadPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
-	otherStub := repository.ApplicationClient("repo/search/v1", otherRT.Client())
+	v1stub := repository.ApplicationClient("repo/search/v1")
+	repostub := repository.ApplicationClient("repo")
 
 	// Create example envelopes.
 	envelopeV1 := application.Envelope{
@@ -132,18 +134,16 @@
 
 	// Envelope putting as other should fail.
 	// TODO(rjkroege): Validate that it is failed with permission denied.
-	if err := otherStub.Put(otherRT.NewContext(), []string{"base"}, envelopeV1); err == nil {
+	if err := v1stub.Put(otherCtx, []string{"base"}, envelopeV1); err == nil {
 		t.Fatalf("Put() wrongly didn't fail")
 	}
 
-	// Envelope putting as self should succeed.
-	selfStub := repository.ApplicationClient("repo/search/v1", selfRT.Client())
-	if err := selfStub.Put(selfRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	// Envelope putting as global should succeed.
+	if err := v1stub.Put(globalCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
 
-	selfStub = repository.ApplicationClient("repo", selfRT.Client())
-	acl, etag, err := selfStub.GetACL(selfRT.NewContext())
+	acl, etag, err := repostub.GetACL(globalCtx)
 	if !verror.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("GetACL should have failed with ErrNotFound but was: %v", err)
 	}
@@ -160,11 +160,11 @@
 		newACL.Add("root/self", string(tag))
 		newACL.Add("root/other", string(tag))
 	}
-	if err := selfStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
+	if err := repostub.SetACL(globalCtx, newACL, ""); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
-	acl, etag, err = selfStub.GetACL(selfRT.NewContext())
+	acl, etag, err = repostub.GetACL(globalCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
@@ -174,28 +174,27 @@
 	}
 
 	// Envelope putting as other should now succeed.
-	if err := otherStub.Put(otherRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	if err := v1stub.Put(otherCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() wrongly failed: %v", err)
 	}
 
 	// Other takes control.
-	otherStub = repository.ApplicationClient("repo/", otherRT.Client())
-	acl, etag, err = otherStub.GetACL(otherRT.NewContext())
+	acl, etag, err = repostub.GetACL(otherCtx)
 	if err != nil {
 		t.Fatalf("GetACL 2 should not have failed: %v", err)
 	}
 	acl["Admin"] = access.ACL{
 		In:    []security.BlessingPattern{"root/other"},
 		NotIn: []string{}}
-	if err = otherStub.SetACL(otherRT.NewContext(), acl, etag); err != nil {
+	if err = repostub.SetACL(otherCtx, acl, etag); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
 	// Self is now locked out but other isn't.
-	if _, _, err = selfStub.GetACL(selfRT.NewContext()); err == nil {
+	if _, _, err = repostub.GetACL(globalCtx); err == nil {
 		t.Fatalf("GetACL should not have succeeded")
 	}
-	acl, _, err = otherStub.GetACL(otherRT.NewContext())
+	acl, _, err = repostub.GetACL(otherCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
@@ -222,29 +221,29 @@
 }
 
 func TestPerAppACL(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// setup mock up directory to put state in
 	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
 	defer cleanup()
 
-	selfRT := globalRT
 	otherRT := mgmttest.NewRuntime(t, globalRT)
 	defer otherRT.Cleanup()
+	otherCtx := otherRT.NewContext()
 	idp := tsecurity.NewIDProvider("root")
 
-	// By default, selfRT and otherRT will have blessings generated based on the
+	// By default, globalRT and otherRT will have blessings generated based on the
 	// username/machine name running this process. Since these blessings will appear
 	// in ACLs, give them recognizable names.
-	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(globalCtx), "self"); err != nil {
 		t.Fatal(err)
 	}
-	if err := idp.Bless(otherRT.Principal(), "other"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(otherCtx), "other"); err != nil {
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "repo")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "repo")
 	defer os.RemoveAll(crDir)
 
 	// Make a server with the same credential as test harness.
@@ -260,19 +259,19 @@
 	}
 
 	// Upload the envelope at two different names.
-	selfStub := repository.ApplicationClient("repo/search/v1", selfRT.Client())
-	if err := selfStub.Put(selfRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	v1stub := repository.ApplicationClient("repo/search/v1")
+	if err := v1stub.Put(globalCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
-	selfStub = repository.ApplicationClient("repo/search/v2", selfRT.Client())
-	if err := selfStub.Put(selfRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	v2stub := repository.ApplicationClient("repo/search/v2")
+	if err := v2stub.Put(globalCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
 
 	// Self can access ACLs but other can't.
 	for _, path := range []string{"repo/search", "repo/search/v1", "repo/search/v2"} {
-		selfStub = repository.ApplicationClient(path, selfRT.Client())
-		acl, etag, err := selfStub.GetACL(selfRT.NewContext())
+		stub := repository.ApplicationClient(path)
+		acl, etag, err := stub.GetACL(globalCtx)
 		if !verror.Is(err, impl.ErrNotFound.ID) {
 			t.Fatalf("GetACL should have failed with ErrNotFound but was: %v", err)
 		}
@@ -282,26 +281,23 @@
 		if acl != nil {
 			t.Fatalf("GetACL got %v, expected %v", acl, nil)
 		}
-		otherStub := repository.ApplicationClient(path, otherRT.Client())
-		if _, _, err := otherStub.GetACL(otherRT.NewContext()); err == nil {
+		if _, _, err := stub.GetACL(otherCtx); err == nil {
 			t.Fatalf("GetACL didn't fail for other when it should have.")
 		}
 	}
 
 	// Self gives other full access only to repo/search/v1.
-	selfStub = repository.ApplicationClient("repo/search/v1", selfRT.Client())
 	newACL := make(access.TaggedACLMap)
 	for _, tag := range access.AllTypicalTags() {
 		newACL.Add("root/self", string(tag))
 		newACL.Add("root/other", string(tag))
 	}
-	if err := selfStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
+	if err := v1stub.SetACL(globalCtx, newACL, ""); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
 	// Other can now access this location.
-	otherStub := repository.ApplicationClient("repo/search/v1", otherRT.Client())
-	acl, _, err := otherStub.GetACL(otherRT.NewContext())
+	acl, _, err := v1stub.GetACL(otherCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
@@ -328,58 +324,54 @@
 
 	// But other locations should be unaffected and other cannot access.
 	for _, path := range []string{"repo/search", "repo/search/v2"} {
-		otherStub := repository.ApplicationClient(path, otherRT.Client())
-		if _, _, err := otherStub.GetACL(otherRT.NewContext()); err == nil {
+		stub := repository.ApplicationClient(path)
+		if _, _, err := stub.GetACL(otherCtx); err == nil {
 			t.Fatalf("GetACL didn't fail for other when it should have.")
 		}
 	}
 
 	// Self gives other write perms on base.
-	selfStub = repository.ApplicationClient("repo/", selfRT.Client())
+	repostub := repository.ApplicationClient("repo/")
 	newACL = make(access.TaggedACLMap)
 	for _, tag := range access.AllTypicalTags() {
 		newACL.Add("root/self", string(tag))
 	}
 	newACL["Write"] = access.ACL{In: []security.BlessingPattern{"root/other", "root/self"}}
-	if err := selfStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
+	if err := repostub.SetACL(globalCtx, newACL, ""); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
 	// Other can now upload an envelope at both locations.
-	for _, path := range []string{"repo/search/v1", "repo/search/v2"} {
-		otherStub = repository.ApplicationClient(path, otherRT.Client())
-		if err := otherStub.Put(otherRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	for _, stub := range []repository.ApplicationClientStub{v1stub, v2stub} {
+		if err := stub.Put(otherCtx, []string{"base"}, envelopeV1); err != nil {
 			t.Fatalf("Put() failed: %v", err)
 		}
 	}
 
 	// But self didn't give other ACL modification permissions.
 	for _, path := range []string{"repo/search", "repo/search/v2"} {
-		otherStub := repository.ApplicationClient(path, otherRT.Client())
-		if _, _, err := otherStub.GetACL(otherRT.NewContext()); err == nil {
+		stub := repository.ApplicationClient(path)
+		if _, _, err := stub.GetACL(otherCtx); err == nil {
 			t.Fatalf("GetACL didn't fail for other when it should have.")
 		}
 	}
 }
 
 func TestInitialACLSet(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Setup mock up directory to put state in.
 	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
 	defer cleanup()
 
-	selfRT := globalRT
-	otherRT := mgmttest.NewRuntime(t, globalRT)
-	defer otherRT.Cleanup()
 	idp := tsecurity.NewIDProvider("root")
 
 	// Make a recognizable principal name.
-	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(globalCtx), "self"); err != nil {
 		t.Fatal(err)
 	}
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "repo")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "repo")
 	defer os.RemoveAll(crDir)
 
 	// Make an TAM for use on the command line.
@@ -402,8 +394,8 @@
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// It should have the correct starting ACLs from the command line.
-	selfStub := repository.ApplicationClient("repo", selfRT.Client())
-	acl, _, err := selfStub.GetACL(selfRT.NewContext())
+	stub := repository.ApplicationClient("repo")
+	acl, _, err := stub.GetACL(globalCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
diff --git a/services/mgmt/application/impl/impl_test.go b/services/mgmt/application/impl/impl_test.go
index 52a0dd1..f826e2f 100644
--- a/services/mgmt/application/impl/impl_test.go
+++ b/services/mgmt/application/impl/impl_test.go
@@ -20,8 +20,6 @@
 // TestInterface tests that the implementation correctly implements
 // the Application interface.
 func TestInterface(t *testing.T) {
-	ctx := globalRT.NewContext()
-
 	dir, prefix := "", ""
 	store, err := ioutil.TempDir(dir, prefix)
 	if err != nil {
@@ -33,7 +31,7 @@
 		t.Fatalf("impl.NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
@@ -58,43 +56,43 @@
 	}
 
 	// Test Put(), adding a number of application envelopes.
-	if err := stubV1.Put(ctx, []string{"base", "media"}, envelopeV1); err != nil {
+	if err := stubV1.Put(globalCtx, []string{"base", "media"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
-	if err := stubV2.Put(ctx, []string{"base"}, envelopeV2); err != nil {
+	if err := stubV2.Put(globalCtx, []string{"base"}, envelopeV2); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
-	if err := stub.Put(ctx, []string{"base", "media"}, envelopeV1); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
+	if err := stub.Put(globalCtx, []string{"base", "media"}, envelopeV1); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrInvalidSuffix, err)
 	}
 
 	// Test Match(), trying to retrieve both existing and non-existing
 	// application envelopes.
 	var output application.Envelope
-	if output, err = stubV2.Match(ctx, []string{"base", "media"}); err != nil {
+	if output, err = stubV2.Match(globalCtx, []string{"base", "media"}); err != nil {
 		t.Fatalf("Match() failed: %v", err)
 	}
 	if !reflect.DeepEqual(envelopeV2, output) {
 		t.Fatalf("Incorrect output: expected %v, got %v", envelopeV2, output)
 	}
-	if output, err = stubV1.Match(ctx, []string{"media"}); err != nil {
+	if output, err = stubV1.Match(globalCtx, []string{"media"}); err != nil {
 		t.Fatalf("Match() failed: %v", err)
 	}
 	if !reflect.DeepEqual(envelopeV1, output) {
 		t.Fatalf("Unexpected output: expected %v, got %v", envelopeV1, output)
 	}
-	if _, err := stubV2.Match(ctx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV2.Match(globalCtx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stubV2.Match(ctx, []string{}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV2.Match(globalCtx, []string{}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stub.Match(ctx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
+	if _, err := stub.Match(globalCtx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrInvalidSuffix, err)
 	}
 
 	// Test Glob
-	matches, err := testutil.GlobName(ctx, naming.JoinAddressName(endpoint, ""), "...")
+	matches, err := testutil.GlobName(globalCtx, naming.JoinAddressName(endpoint, ""), "...")
 	if err != nil {
 		t.Errorf("Unexpected Glob error: %v", err)
 	}
@@ -110,34 +108,34 @@
 
 	// Test Remove(), trying to remove both existing and non-existing
 	// application envelopes.
-	if err := stubV1.Remove(ctx, "base"); err != nil {
+	if err := stubV1.Remove(globalCtx, "base"); err != nil {
 		t.Fatalf("Remove() failed: %v", err)
 	}
-	if output, err = stubV1.Match(ctx, []string{"media"}); err != nil {
+	if output, err = stubV1.Match(globalCtx, []string{"media"}); err != nil {
 		t.Fatalf("Match() failed: %v", err)
 	}
-	if err := stubV1.Remove(ctx, "base"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if err := stubV1.Remove(globalCtx, "base"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if err := stub.Remove(ctx, "base"); err != nil {
+	if err := stub.Remove(globalCtx, "base"); err != nil {
 		t.Fatalf("Remove() failed: %v", err)
 	}
-	if err := stubV2.Remove(ctx, "media"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if err := stubV2.Remove(globalCtx, "media"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if err := stubV1.Remove(ctx, "media"); err != nil {
+	if err := stubV1.Remove(globalCtx, "media"); err != nil {
 		t.Fatalf("Remove() failed: %v", err)
 	}
 
 	// Finally, use Match() to test that Remove really removed the
 	// application envelopes.
-	if _, err := stubV1.Match(ctx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV1.Match(globalCtx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stubV1.Match(ctx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV1.Match(globalCtx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stubV2.Match(ctx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV2.Match(globalCtx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
 
@@ -160,7 +158,7 @@
 		t.Fatalf("impl.NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
@@ -177,12 +175,12 @@
 		Binary: "/veyron/name/of/binary",
 	}
 
-	if err := stubV1.Put(globalRT.NewContext(), []string{"media"}, envelopeV1); err != nil {
+	if err := stubV1.Put(globalCtx, []string{"media"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
 
 	// There is content here now.
-	output, err := stubV1.Match(globalRT.NewContext(), []string{"media"})
+	output, err := stubV1.Match(globalCtx, []string{"media"})
 	if err != nil {
 		t.Fatalf("Match(%v) failed: %v", "media", err)
 	}
@@ -198,7 +196,7 @@
 		t.Fatalf("impl.NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint = mgmttest.NewServer(globalRT)
+	server, endpoint = mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
@@ -207,7 +205,7 @@
 
 	stubV1 = repository.ApplicationClient(naming.JoinAddressName(endpoint, "search/v1"))
 
-	output, err = stubV1.Match(globalRT.NewContext(), []string{"media"})
+	output, err = stubV1.Match(globalCtx, []string{"media"})
 	if err != nil {
 		t.Fatalf("Match(%v) failed: %v", "media", err)
 	}
diff --git a/services/mgmt/device/deviced/commands.go b/services/mgmt/device/deviced/commands.go
index c151c8b..edf5e95 100644
--- a/services/mgmt/device/deviced/commands.go
+++ b/services/mgmt/device/deviced/commands.go
@@ -117,7 +117,7 @@
 		return err
 	}
 	defer runtime.Cleanup()
-	if err := impl.Stop(installationDir(), runtime); err != nil {
+	if err := impl.Stop(runtime.NewContext(), installationDir()); err != nil {
 		vlog.Errorf("Stop failed: %v", err)
 		return err
 	}
diff --git a/services/mgmt/device/impl/app_service.go b/services/mgmt/device/impl/app_service.go
index 00d8320..aebe580 100644
--- a/services/mgmt/device/impl/app_service.go
+++ b/services/mgmt/device/impl/app_service.go
@@ -460,10 +460,14 @@
 		// TODO(caprita): Part of the cleanup upon destroying an
 		// instance, we should tell the agent to drop the principal.
 		handle, conn, err := securityAgent.keyMgrAgent.NewPrincipal(ctx, false)
+		if err != nil {
+			vlog.Errorf("NewPrincipal() failed %v", err)
+			return verror2.Make(ErrOperationFailed, nil)
+		}
 		defer conn.Close()
 
 		// TODO(caprita): release the socket created by NewAgentPrincipal.
-		if p, err = agent.NewAgentPrincipal(int(conn.Fd()), ctx); err != nil {
+		if p, err = agent.NewAgentPrincipal(ctx, int(conn.Fd())); err != nil {
 			vlog.Errorf("NewAgentPrincipal() failed: %v", err)
 			return verror2.Make(ErrOperationFailed, nil)
 		}
diff --git a/services/mgmt/device/impl/device_installer.go b/services/mgmt/device/impl/device_installer.go
index 77f6397..15cf0ca 100644
--- a/services/mgmt/device/impl/device_installer.go
+++ b/services/mgmt/device/impl/device_installer.go
@@ -10,7 +10,7 @@
 	"regexp"
 	"strings"
 
-	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/services/mgmt/application"
 	"v.io/core/veyron2/services/mgmt/device"
 
@@ -191,13 +191,13 @@
 }
 
 // Stop stops the device manager.
-func Stop(installDir string, runtime veyron2.Runtime) error {
+func Stop(ctx *context.T, installDir string) error {
 	root := filepath.Join(installDir, dmRoot)
 	info, err := loadManagerInfo(filepath.Join(root, "device-manager"))
 	if err != nil {
 		return fmt.Errorf("loadManagerInfo failed: %v", err)
 	}
-	if err := device.ApplicationClient(info.MgrName).Stop(runtime.NewContext(), 5); err != nil {
+	if err := device.ApplicationClient(info.MgrName).Stop(ctx, 5); err != nil {
 		return fmt.Errorf("Stop failed: %v", err)
 	}
 	// TODO(caprita): Wait for the (device|agent) process to be gone.
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index d5c7242..838e1eb 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -85,7 +85,6 @@
 }
 
 var globalRT veyron2.Runtime
-
 var globalCtx *context.T
 
 func initRT(opts ...veyron2.ROpt) {
@@ -158,7 +157,7 @@
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
 	defer vlog.VI(1).Infof("%v terminating", publishName)
 	defer globalRT.Cleanup()
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 	name := naming.JoinAddressName(endpoint, "")
 	vlog.VI(1).Infof("Device manager name: %v", name)
@@ -180,14 +179,14 @@
 		}
 		configState.Root, configState.Helper, configState.Origin, configState.CurrentLink = args[0], args[1], args[2], args[3]
 	}
-	dispatcher, err := impl.NewDispatcher(globalRT.Principal(), configState, func() { fmt.Println("stop handler") })
+	dispatcher, err := impl.NewDispatcher(veyron2.GetPrincipal(globalCtx), configState, func() { fmt.Println("stop handler") })
 	if err != nil {
 		vlog.Fatalf("Failed to create device manager dispatcher: %v", err)
 	}
 	if err := server.ServeDispatcher(publishName, dispatcher); err != nil {
 		vlog.Fatalf("Serve(%v) failed: %v", publishName, err)
 	}
-	impl.InvokeCallback(globalRT.NewContext(), name)
+	impl.InvokeCallback(globalCtx, name)
 
 	fmt.Fprintf(stdout, "ready:%d\n", os.Getpid())
 
@@ -223,7 +222,8 @@
 }
 
 func ping() {
-	if call, err := globalRT.Client().StartCall(globalRT.NewContext(), "pingserver", "Ping", []interface{}{os.Getenv(suidhelper.SavedArgs)}); err != nil {
+	client := veyron2.GetClient(globalCtx)
+	if call, err := client.StartCall(globalCtx, "pingserver", "Ping", []interface{}{os.Getenv(suidhelper.SavedArgs)}); err != nil {
 		vlog.Fatalf("StartCall failed: %v", err)
 	} else if err := call.Finish(); err != nil {
 		vlog.Fatalf("Finish failed: %v", err)
@@ -231,9 +231,10 @@
 }
 
 func cat(name, file string) (string, error) {
-	ctx, cancel := context.WithTimeout(globalRT.NewContext(), time.Minute)
+	ctx, cancel := context.WithTimeout(globalCtx, time.Minute)
 	defer cancel()
-	call, err := globalRT.Client().StartCall(ctx, name, "Cat", []interface{}{file})
+	client := veyron2.GetClient(globalCtx)
+	call, err := client.StartCall(ctx, name, "Cat", []interface{}{file})
 	if err != nil {
 		return "", err
 	}
@@ -252,7 +253,7 @@
 	publishName := args[0]
 
 	defer globalRT.Cleanup()
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 	if err := server.Serve(publishName, new(appService), nil); err != nil {
 		vlog.Fatalf("Serve(%v) failed: %v", publishName, err)
@@ -301,7 +302,7 @@
 // command. Further versions are started through the soft link that the device
 // manager itself updates.
 func TestDeviceManagerUpdateAndRevert(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -315,7 +316,7 @@
 	// convenient to put it there so we have everything in one place.
 	currLink := filepath.Join(root, "current_link")
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 	dmArgs := []string{"factoryDM", root, "unused_helper", mockApplicationRepoName, currLink}
 	args, env := sh.CommandEnvelope(deviceManagerCmd, crEnv, dmArgs...)
@@ -354,7 +355,7 @@
 	// Set up a second version of the device manager. The information in the
 	// envelope will be used by the device manager to stage the next
 	// version.
-	crDir, crEnv = mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv = mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v2DM")
 	updateDevice(t, "factoryDM")
@@ -397,7 +398,7 @@
 	}
 
 	// Create a third version of the device manager and issue an update.
-	crDir, crEnv = mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv = mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v3DM")
 	updateDevice(t, "v2DM")
@@ -478,7 +479,7 @@
 // returns a channel on which the app's ping message is returned, and a cleanup
 // function.
 func setupPingServer(t *testing.T) (<-chan string, func()) {
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	pingCh := make(chan string, 1)
 	if err := server.Serve("pingserver", pingServer(pingCh), &openAuthorizer{}); err != nil {
 		t.Fatalf("Serve(%q, <dispatcher>) failed: %v", "pingserver", err)
@@ -539,7 +540,7 @@
 // TestAppLifeCycle installs an app, starts it, suspends it, resumes it, and
 // then stops it.
 func TestAppLifeCycle(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -552,7 +553,7 @@
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Set up the device manager.  Since we won't do device manager updates,
@@ -730,7 +731,7 @@
 	if err != nil {
 		t.Fatalf("binaryimpl.NewState failed: %v", err)
 	}
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	name := "realbin"
 	if err := server.ServeDispatcher(name, binaryimpl.NewDispatcher(state, nil)); err != nil {
 		t.Fatalf("server.ServeDispatcher failed: %v", err)
@@ -744,7 +745,7 @@
 	if err := ioutil.WriteFile(filepath.Join(tmpdir, "hello.txt"), []byte("Hello World!"), 0600); err != nil {
 		t.Fatalf("ioutil.WriteFile failed: %v", err)
 	}
-	if err := libbinary.UploadFromDir(globalRT.NewContext(), naming.Join(name, "testpkg"), tmpdir); err != nil {
+	if err := libbinary.UploadFromDir(globalCtx, naming.Join(name, "testpkg"), tmpdir); err != nil {
 		t.Fatalf("libbinary.UploadFromDir failed: %v", err)
 	}
 	return func() {
@@ -760,7 +761,7 @@
 // TestDeviceManagerClaim claims a devicemanager and tests ACL permissions on
 // its methods.
 func TestDeviceManagerClaim(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -770,7 +771,7 @@
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -832,7 +833,7 @@
 }
 
 func TestDeviceManagerUpdateACL(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -861,7 +862,7 @@
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Set up the device manager.  Since we won't do device manager updates,
@@ -942,7 +943,7 @@
 // This should bring up a functioning device manager.  In the end it runs
 // Uninstall and verifies that the installation is gone.
 func TestDeviceManagerInstallation(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 	testDir, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
@@ -974,7 +975,7 @@
 	revertDeviceExpectError(t, "dm", impl.ErrUpdateNoOp.ID) // No previous version available.
 
 	// Stop the device manager.
-	if err := impl.Stop(dmDir, globalRT); err != nil {
+	if err := impl.Stop(globalCtx, dmDir); err != nil {
 		t.Fatalf("Stop failed: %v", err)
 	}
 	dms.Expect("stop handler")
@@ -995,7 +996,7 @@
 }
 
 func TestDeviceManagerGlobAndDebug(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -1005,7 +1006,7 @@
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -1082,7 +1083,7 @@
 	logFileRemoveErrorFatalWarningRE := regexp.MustCompile("(ERROR|FATAL|WARNING)")
 	statsTrimRE := regexp.MustCompile("/stats/(ipc|system(/start-time.*)?)$")
 	for _, tc := range testcases {
-		results, err := testutil.GlobName(globalRT.NewContext(), tc.name, tc.pattern)
+		results, err := testutil.GlobName(globalCtx, tc.name, tc.pattern)
 		if err != nil {
 			t.Errorf("unexpected glob error for (%q, %q): %v", tc.name, tc.pattern, err)
 			continue
@@ -1110,7 +1111,7 @@
 	}
 
 	// Call Size() on the log file objects.
-	files, err := testutil.GlobName(globalRT.NewContext(), "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/logs/*")
+	files, err := testutil.GlobName(globalCtx, "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/logs/*")
 	if err != nil {
 		t.Errorf("unexpected glob error: %v", err)
 	}
@@ -1120,13 +1121,13 @@
 	for _, file := range files {
 		name := naming.Join("dm", file)
 		c := logreader.LogFileClient(name)
-		if _, err := c.Size(globalRT.NewContext()); err != nil {
+		if _, err := c.Size(globalCtx); err != nil {
 			t.Errorf("Size(%q) failed: %v", name, err)
 		}
 	}
 
 	// Call Value() on some of the stats objects.
-	objects, err := testutil.GlobName(globalRT.NewContext(), "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/stats/system/start-time*")
+	objects, err := testutil.GlobName(globalCtx, "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/stats/system/start-time*")
 	if err != nil {
 		t.Errorf("unexpected glob error: %v", err)
 	}
@@ -1136,7 +1137,7 @@
 	for _, obj := range objects {
 		name := naming.Join("dm", obj)
 		c := stats.StatsClient(name)
-		if _, err := c.Value(globalRT.NewContext()); err != nil {
+		if _, err := c.Value(globalCtx); err != nil {
 			t.Errorf("Value(%q) failed: %v", name, err)
 		}
 	}
@@ -1145,7 +1146,7 @@
 	{
 		name := "dm/apps/google naps/" + install1ID + "/" + instance1ID + "/pprof"
 		c := pprof.PProfClient(name)
-		v, err := c.CmdLine(globalRT.NewContext())
+		v, err := c.CmdLine(globalCtx)
 		if err != nil {
 			t.Errorf("CmdLine(%q) failed: %v", name, err)
 		}
@@ -1159,7 +1160,7 @@
 }
 
 func TestDeviceManagerPackages(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -1171,7 +1172,7 @@
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -1229,7 +1230,7 @@
 // TODO(rjkroege): Verify that associations persist across restarts once
 // permanent storage is added.
 func TestAccountAssociation(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
@@ -1252,7 +1253,7 @@
 	if err := idp.Bless(otherRT.Principal(), "other"); err != nil {
 		t.Fatal(err)
 	}
-	crFile, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crFile, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crFile)
 
 	_, dms := mgmttest.RunShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
@@ -1328,7 +1329,7 @@
 }
 
 func TestAppWithSuidHelper(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -1357,7 +1358,7 @@
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -1371,7 +1372,7 @@
 
 	// Create the local server that the app uses to tell us which system
 	// name the device manager wished to run it as.
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 	pingCh := make(chan string, 1)
 	if err := server.Serve("pingserver", pingServer(pingCh), nil); err != nil {
diff --git a/services/mgmt/device/impl/mock_repo_test.go b/services/mgmt/device/impl/mock_repo_test.go
index 82644a3..16fed19 100644
--- a/services/mgmt/device/impl/mock_repo_test.go
+++ b/services/mgmt/device/impl/mock_repo_test.go
@@ -37,7 +37,7 @@
 // repository.  It returns a pointer to the envelope that the repository returns
 // to clients (so that it can be changed).  It also returns a cleanup function.
 func startApplicationRepository() (*application.Envelope, func()) {
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	invoker := new(arInvoker)
 	name := mockApplicationRepoName
 	if err := server.Serve(name, repository.ApplicationServer(invoker), &openAuthorizer{}); err != nil {
@@ -82,7 +82,7 @@
 // startBinaryRepository sets up a server running the binary repository and
 // returns a cleanup function.
 func startBinaryRepository() func() {
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	name := mockBinaryRepoName
 	if err := server.Serve(name, repository.BinaryServer(new(brInvoker)), &openAuthorizer{}); err != nil {
 		vlog.Fatalf("Serve(%q) failed: %v", name, err)
diff --git a/services/mgmt/device/impl/proxy_invoker.go b/services/mgmt/device/impl/proxy_invoker.go
index e08be24..506d57f 100644
--- a/services/mgmt/device/impl/proxy_invoker.go
+++ b/services/mgmt/device/impl/proxy_invoker.go
@@ -47,8 +47,10 @@
 	for i, ap := range argptrs {
 		args[i] = ap
 	}
-	runtime := veyron2.RuntimeFromContext(inCall.Context())
-	outCall, err := runtime.Client().StartCall(inCall.Context(), p.remote, method, args)
+	ctx := inCall.Context()
+	client := veyron2.GetClient(ctx)
+
+	outCall, err := client.StartCall(ctx, p.remote, method, args)
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/mgmt/lib/testutil/modules.go b/services/mgmt/lib/testutil/modules.go
index d9ec550..8b801e5 100644
--- a/services/mgmt/lib/testutil/modules.go
+++ b/services/mgmt/lib/testutil/modules.go
@@ -8,6 +8,7 @@
 	"testing"
 
 	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/rt"
 	"v.io/core/veyron2/vlog"
@@ -44,21 +45,22 @@
 }
 
 // CredentialsForChild creates credentials for a child process.
-func CredentialsForChild(rt veyron2.Runtime, blessing string) (string, []string) {
-	creds, _ := security.ForkCredentials(rt.Principal(), blessing)
+func CredentialsForChild(ctx *context.T, blessing string) (string, []string) {
+	creds, _ := security.ForkCredentials(veyron2.GetPrincipal(ctx), blessing)
 	return creds, []string{consts.VeyronCredentials + "=" + creds}
 }
 
 // SetNSRoots sets the roots for the local runtime's namespace.
-func SetNSRoots(t *testing.T, rt veyron2.Runtime, roots ...string) {
-	if err := rt.Namespace().SetRoots(roots...); err != nil {
+func SetNSRoots(t *testing.T, ctx *context.T, roots ...string) {
+	ns := veyron2.GetNamespace(ctx)
+	if err := ns.SetRoots(roots...); err != nil {
 		t.Fatalf(testutil.FormatLogLine(3, "SetRoots(%v) failed with %v", roots, err))
 	}
 }
 
 // CreateShellAndMountTable builds a new modules shell and its
 // associated mount table.
-func CreateShellAndMountTable(t *testing.T, rt veyron2.Runtime) (*modules.Shell, func()) {
+func CreateShellAndMountTable(t *testing.T, ctx *context.T) (*modules.Shell, func()) {
 	sh, err := modules.NewShell(nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
@@ -75,7 +77,8 @@
 
 	// TODO(caprita): Define a GetNamespaceRootsCommand in modules/core and
 	// use that?
-	oldNamespaceRoots := rt.Namespace().Roots()
+
+	oldNamespaceRoots := veyron2.GetNamespace(ctx).Roots()
 	fn := func() {
 		vlog.VI(1).Info("------------ CLEANUP ------------")
 		vlog.VI(1).Info("---------------------------------")
@@ -90,9 +93,9 @@
 		}
 		vlog.VI(1).Info("--(done shutting down root mt)---")
 		vlog.VI(1).Info("--------- DONE CLEANUP ----------")
-		SetNSRoots(t, rt, oldNamespaceRoots...)
+		SetNSRoots(t, ctx, oldNamespaceRoots...)
 	}
-	SetNSRoots(t, rt, mtName)
+	SetNSRoots(t, ctx, mtName)
 	sh.SetVar(consts.NamespaceRootPrefix, mtName)
 	return sh, fn
 }
@@ -110,8 +113,8 @@
 }
 
 // NewServer creates a new server.
-func NewServer(rt veyron2.Runtime) (ipc.Server, string) {
-	server, err := rt.NewServer()
+func NewServer(ctx *context.T) (ipc.Server, string) {
+	server, err := veyron2.NewServer(ctx)
 	if err != nil {
 		vlog.Fatalf("NewServer() failed: %v", err)
 	}
diff --git a/services/mounttable/lib/mounttable_test.go b/services/mounttable/lib/mounttable_test.go
index 4240970..3f4ab6a 100644
--- a/services/mounttable/lib/mounttable_test.go
+++ b/services/mounttable/lib/mounttable_test.go
@@ -11,6 +11,7 @@
 	"time"
 
 	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/options"
@@ -24,8 +25,8 @@
 )
 
 // Simulate different processes with different runtimes.
-// rootRT is the one running the mounttable service.
-var rootRT, aliceRT, bobRT veyron2.Runtime
+// rootCtx is the one running the mounttable service.
+var rootCtx, aliceCtx, bobCtx *context.T
 
 const ttlSecs = 60 * 60
 
@@ -34,10 +35,9 @@
 	t.Fatal(string(debug.Stack()))
 }
 
-func doMount(t *testing.T, ep, suffix, service string, shouldSucceed bool, as veyron2.Runtime) {
+func doMount(t *testing.T, ctx *context.T, ep, suffix, service string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Mount", []interface{}{service, uint32(ttlSecs), 0}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -59,10 +59,9 @@
 	}
 }
 
-func doUnmount(t *testing.T, ep, suffix, service string, shouldSucceed bool, as veyron2.Runtime) {
+func doUnmount(t *testing.T, ctx *context.T, ep, suffix, service string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Unmount", []interface{}{service}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -84,10 +83,9 @@
 	}
 }
 
-func doGetACL(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) (acl access.TaggedACLMap, etag string) {
+func doGetACL(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) (acl access.TaggedACLMap, etag string) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "GetACL", nil, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -110,10 +108,9 @@
 	return
 }
 
-func doSetACL(t *testing.T, ep, suffix string, acl access.TaggedACLMap, etag string, shouldSucceed bool, as veyron2.Runtime) {
+func doSetACL(t *testing.T, ctx *context.T, ep, suffix string, acl access.TaggedACLMap, etag string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "SetACL", []interface{}{acl, etag}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -136,10 +133,9 @@
 	return
 }
 
-func doDeleteNode(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) {
+func doDeleteNode(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Delete", []interface{}{false}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -161,10 +157,9 @@
 	}
 }
 
-func doDeleteSubtree(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) {
+func doDeleteSubtree(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Delete", []interface{}{true}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -187,10 +182,9 @@
 }
 
 // resolve assumes that the mount contains 0 or 1 servers.
-func resolve(name string, as veyron2.Runtime) (string, error) {
+func resolve(ctx *context.T, name string) (string, error) {
 	// Resolve the name one level.
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "ResolveStepX", nil, options.NoResolve{})
 	if err != nil {
 		return "", err
@@ -205,15 +199,14 @@
 	return naming.JoinAddressName(entry.Servers[0].Server, entry.Name), nil
 }
 
-func export(t *testing.T, name, contents string, as veyron2.Runtime) {
+func export(t *testing.T, ctx *context.T, name, contents string) {
 	// Resolve the name.
-	resolved, err := resolve(name, as)
+	resolved, err := resolve(ctx, name)
 	if err != nil {
 		boom(t, "Failed to Export.Resolve %s: %s", name, err)
 	}
 	// Export the value.
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, resolved, "Export", []interface{}{contents, true}, options.NoResolve{})
 	if err != nil {
 		boom(t, "Failed to Export.StartCall %s to %s: %s", name, contents, err)
@@ -226,9 +219,9 @@
 	}
 }
 
-func checkContents(t *testing.T, name, expected string, shouldSucceed bool, as veyron2.Runtime) {
+func checkContents(t *testing.T, ctx *context.T, name, expected string, shouldSucceed bool) {
 	// Resolve the name.
-	resolved, err := resolve(name, as)
+	resolved, err := resolve(ctx, name)
 	if err != nil {
 		if !shouldSucceed {
 			return
@@ -236,8 +229,7 @@
 		boom(t, "Failed to Resolve %s: %s", name, err)
 	}
 	// Look up the value.
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, resolved, "Lookup", nil, options.NoResolve{})
 	if err != nil {
 		if shouldSucceed {
@@ -264,7 +256,7 @@
 }
 
 func newMT(t *testing.T, acl string) (ipc.Server, string) {
-	server, err := rootRT.NewServer(options.ServesMountTable(true))
+	server, err := veyron2.NewServer(rootCtx, options.ServesMountTable(true))
 	if err != nil {
 		boom(t, "r.NewServer: %s", err)
 	}
@@ -287,7 +279,7 @@
 }
 
 func newCollection(t *testing.T, acl string) (ipc.Server, string) {
-	server, err := rootRT.NewServer()
+	server, err := veyron2.NewServer(rootCtx)
 	if err != nil {
 		boom(t, "r.NewServer: %s", err)
 	}
@@ -317,81 +309,80 @@
 
 	// Mount the collection server into the mount table.
 	vlog.Infof("Mount the collection server into the mount table.")
-	doMount(t, mtAddr, "stuff", collectionName, true, rootRT)
+	doMount(t, rootCtx, mtAddr, "stuff", collectionName, true)
 
 	// Create a few objects and make sure we can read them.
 	vlog.Infof("Create a few objects.")
-	export(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", rootRT)
-	export(t, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain", rootRT)
-	export(t, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", rootRT)
+	export(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain")
+	export(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain")
+	export(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain")
 	vlog.Infof("Make sure we can read them.")
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "/stuff/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/nonexistant"), "falls mainly on the plain", false, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true, bobRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", false, aliceRT)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "/stuff/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/nonexistant"), "falls mainly on the plain", false)
+	checkContents(t, bobCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true)
+	checkContents(t, aliceCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", false)
 
 	// Test multiple mounts.
 	vlog.Infof("Multiple mounts.")
-	doMount(t, mtAddr, "a/b", collectionName, true, rootRT)
-	doMount(t, mtAddr, "x/y", collectionName, true, rootRT)
-	doMount(t, mtAddr, "alpha//beta", collectionName, true, rootRT)
+	doMount(t, rootCtx, mtAddr, "a/b", collectionName, true)
+	doMount(t, rootCtx, mtAddr, "x/y", collectionName, true)
+	doMount(t, rootCtx, mtAddr, "alpha//beta", collectionName, true)
 	vlog.Infof("Make sure we can read them.")
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "x/y/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "alpha/beta/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true, aliceRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false, bobRT)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "x/y/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "alpha/beta/falls"), "falls mainly on the plain", true)
+	checkContents(t, aliceCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true)
+	checkContents(t, bobCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false)
 
 	// Test getting/setting ACLs.
-	acl, etag := doGetACL(t, mtAddr, "stuff", true, rootRT)
-	doSetACL(t, mtAddr, "stuff", acl, "xyzzy", false, rootRT) // bad etag
-	doSetACL(t, mtAddr, "stuff", acl, etag, true, rootRT)     // good etag
-	_, netag := doGetACL(t, mtAddr, "stuff", true, rootRT)
+	acl, etag := doGetACL(t, rootCtx, mtAddr, "stuff", true)
+	doSetACL(t, rootCtx, mtAddr, "stuff", acl, "xyzzy", false) // bad etag
+	doSetACL(t, rootCtx, mtAddr, "stuff", acl, etag, true)     // good etag
+	_, netag := doGetACL(t, rootCtx, mtAddr, "stuff", true)
 	if netag == etag {
 		boom(t, "etag didn't change after SetACL: %s", netag)
 	}
-	doSetACL(t, mtAddr, "stuff", acl, "", true, rootRT) // no etag
+	doSetACL(t, rootCtx, mtAddr, "stuff", acl, "", true) // no etag
 
 	// Bob should be able to create nodes under the mounttable root but not alice.
-	doSetACL(t, mtAddr, "onlybob", acl, "", false, aliceRT)
-	doSetACL(t, mtAddr, "onlybob", acl, "", true, bobRT)
+	doSetACL(t, aliceCtx, mtAddr, "onlybob", acl, "", false)
+	doSetACL(t, bobCtx, mtAddr, "onlybob", acl, "", true)
 
 	// Test generic unmount.
 	vlog.Info("Test generic unmount.")
-	doUnmount(t, mtAddr, "a/b", "", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false, rootRT)
+	doUnmount(t, rootCtx, mtAddr, "a/b", "", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false)
 
 	// Test specific unmount.
 	vlog.Info("Test specific unmount.")
-	doMount(t, mtAddr, "a/b", collectionName, true, rootRT)
-	doUnmount(t, mtAddr, "a/b", collectionName, true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false, rootRT)
+	doMount(t, rootCtx, mtAddr, "a/b", collectionName, true)
+	doUnmount(t, rootCtx, mtAddr, "a/b", collectionName, true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false)
 
 	// Try timing out a mount.
 	vlog.Info("Try timing out a mount.")
 	ft := NewFakeTimeClock()
 	setServerListClock(ft)
-	doMount(t, mtAddr, "stuffWithTTL", collectionName, true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", true, rootRT)
+	doMount(t, rootCtx, mtAddr, "stuffWithTTL", collectionName, true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", true)
 	ft.advance(time.Duration(ttlSecs+4) * time.Second)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", false, rootRT)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", false)
 
 	// Test unauthorized mount.
 	vlog.Info("Test unauthorized mount.")
-	doMount(t, mtAddr, "/a/b", collectionName, false, bobRT)
-	doMount(t, mtAddr, "/a/b", collectionName, false, aliceRT)
+	doMount(t, bobCtx, mtAddr, "/a/b", collectionName, false)
+	doMount(t, aliceCtx, mtAddr, "/a/b", collectionName, false)
 
-	doUnmount(t, mtAddr, "x/y", collectionName, false, bobRT)
+	doUnmount(t, bobCtx, mtAddr, "x/y", collectionName, false)
 }
 
-func doGlobX(t *testing.T, ep, suffix, pattern string, as veyron2.Runtime, joinServer bool) []string {
+func doGlobX(t *testing.T, ctx *context.T, ep, suffix, pattern string, joinServer bool) []string {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, ipc.GlobMethod, []interface{}{pattern}, options.NoResolve{})
 	if err != nil {
 		boom(t, "Glob.StartCall %s %s: %s", name, pattern, err)
@@ -421,8 +412,8 @@
 	return reply
 }
 
-func doGlob(t *testing.T, ep, suffix, pattern string, as veyron2.Runtime) []string {
-	return doGlobX(t, ep, suffix, pattern, as, false)
+func doGlob(t *testing.T, ctx *context.T, ep, suffix, pattern string) []string {
+	return doGlobX(t, ctx, ep, suffix, pattern, false)
 }
 
 // checkMatch verified that the two slices contain the same string items, albeit
@@ -439,8 +430,8 @@
 }
 
 // checkExists makes sure a name exists (or not).
-func checkExists(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) {
-	x := doGlobX(t, ep, "", suffix, as, false)
+func checkExists(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) {
+	x := doGlobX(t, ctx, ep, "", suffix, false)
 	if len(x) != 1 || x[0] != suffix {
 		if shouldSucceed {
 			boom(t, "Failed to find %s", suffix)
@@ -458,9 +449,9 @@
 
 	// set up a mount space
 	fakeServer := naming.JoinAddressName(estr, "quux")
-	doMount(t, estr, "one/bright/day", fakeServer, true, rootRT)
-	doMount(t, estr, "in/the/middle", fakeServer, true, rootRT)
-	doMount(t, estr, "of/the/night", fakeServer, true, rootRT)
+	doMount(t, rootCtx, estr, "one/bright/day", fakeServer, true)
+	doMount(t, rootCtx, estr, "in/the/middle", fakeServer, true)
+	doMount(t, rootCtx, estr, "of/the/night", fakeServer, true)
 
 	// Try various globs.
 	tests := []struct {
@@ -478,14 +469,14 @@
 		{"", []string{""}},
 	}
 	for _, test := range tests {
-		out := doGlob(t, estr, "", test.in, rootRT)
+		out := doGlob(t, rootCtx, estr, "", test.in)
 		checkMatch(t, test.expected, out)
 	}
 
 	// Test Glob on a name that is under a mounted server. The result should the
 	// the address the mounted server with the extra suffix.
 	{
-		results := doGlobX(t, estr, "of/the/night/two/dead/boys/got/up/to/fight", "*", rootRT, true)
+		results := doGlobX(t, rootCtx, estr, "of/the/night/two/dead/boys/got/up/to/fight", "*", true)
 		if len(results) != 1 {
 			boom(t, "Unexpected number of results. Got %v, want 1", len(results))
 		}
@@ -502,14 +493,14 @@
 	fakeServer := naming.JoinAddressName(estr, "quux")
 
 	// Noone should be able to mount on someone else's names.
-	doMount(t, estr, "users/ted", fakeServer, false, aliceRT)
-	doMount(t, estr, "users/carol", fakeServer, false, bobRT)
-	doMount(t, estr, "users/george", fakeServer, false, rootRT)
+	doMount(t, aliceCtx, estr, "users/ted", fakeServer, false)
+	doMount(t, bobCtx, estr, "users/carol", fakeServer, false)
+	doMount(t, rootCtx, estr, "users/george", fakeServer, false)
 
 	// Anyone should be able to mount on their own names.
-	doMount(t, estr, "users/alice", fakeServer, true, aliceRT)
-	doMount(t, estr, "users/bob", fakeServer, true, bobRT)
-	doMount(t, estr, "users/root", fakeServer, true, rootRT)
+	doMount(t, aliceCtx, estr, "users/alice", fakeServer, true)
+	doMount(t, bobCtx, estr, "users/bob", fakeServer, true)
+	doMount(t, rootCtx, estr, "users/root", fakeServer, true)
 }
 
 func TestGlobACLs(t *testing.T) {
@@ -518,26 +509,26 @@
 
 	// set up a mount space
 	fakeServer := naming.JoinAddressName(estr, "quux")
-	doMount(t, estr, "one/bright/day", fakeServer, false, aliceRT) // Fails because alice can't mount there.
-	doMount(t, estr, "one/bright/day", fakeServer, true, bobRT)
-	doMount(t, estr, "a/b/c", fakeServer, true, rootRT)
+	doMount(t, aliceCtx, estr, "one/bright/day", fakeServer, false) // Fails because alice can't mount there.
+	doMount(t, bobCtx, estr, "one/bright/day", fakeServer, true)
+	doMount(t, rootCtx, estr, "a/b/c", fakeServer, true)
 
 	// Try various globs.
 	tests := []struct {
-		as       veyron2.Runtime
+		ctx      *context.T
 		in       string
 		expected []string
 	}{
-		{rootRT, "*", []string{"one", "a", "stuff", "users"}},
-		{aliceRT, "*", []string{"one", "a", "users"}},
-		{bobRT, "*", []string{"one", "stuff", "users"}},
+		{rootCtx, "*", []string{"one", "a", "stuff", "users"}},
+		{aliceCtx, "*", []string{"one", "a", "users"}},
+		{bobCtx, "*", []string{"one", "stuff", "users"}},
 		// bob, alice, and root have different visibility to the space.
-		{rootRT, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "stuff", "users"}},
-		{aliceRT, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "users"}},
-		{bobRT, "*/...", []string{"one", "one/bright", "one/bright/day", "stuff", "users"}},
+		{rootCtx, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "stuff", "users"}},
+		{aliceCtx, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "users"}},
+		{bobCtx, "*/...", []string{"one", "one/bright", "one/bright/day", "stuff", "users"}},
 	}
 	for _, test := range tests {
-		out := doGlob(t, estr, "", test.in, test.as)
+		out := doGlob(t, test.ctx, estr, "", test.in)
 		checkMatch(t, test.expected, out)
 	}
 }
@@ -548,34 +539,34 @@
 
 	// set up a mount space
 	fakeServer := naming.JoinAddressName(estr, "quux")
-	doMount(t, estr, "one/bright/day", fakeServer, true, bobRT)
-	doMount(t, estr, "a/b/c", fakeServer, true, rootRT)
+	doMount(t, bobCtx, estr, "one/bright/day", fakeServer, true)
+	doMount(t, rootCtx, estr, "a/b/c", fakeServer, true)
 
 	// It shouldn't be possible to delete anything with children unless explicitly requested.
-	doDeleteNode(t, estr, "a/b", false, rootRT)
-	checkExists(t, estr, "a/b", true, rootRT)
-	doDeleteSubtree(t, estr, "a/b", true, rootRT)
-	checkExists(t, estr, "a/b", false, rootRT)
+	doDeleteNode(t, rootCtx, estr, "a/b", false)
+	checkExists(t, rootCtx, estr, "a/b", true)
+	doDeleteSubtree(t, rootCtx, estr, "a/b", true)
+	checkExists(t, rootCtx, estr, "a/b", false)
 
 	// Alice shouldn't be able to delete what bob created but bob and root should.
-	doDeleteNode(t, estr, "one/bright/day", false, aliceRT)
-	checkExists(t, estr, "one/bright/day", true, rootRT)
-	doDeleteNode(t, estr, "one/bright/day", true, rootRT)
-	checkExists(t, estr, "one/bright/day", false, rootRT)
-	doDeleteNode(t, estr, "one/bright", true, bobRT)
-	checkExists(t, estr, "one/bright", false, rootRT)
+	doDeleteNode(t, aliceCtx, estr, "one/bright/day", false)
+	checkExists(t, rootCtx, estr, "one/bright/day", true)
+	doDeleteNode(t, rootCtx, estr, "one/bright/day", true)
+	checkExists(t, rootCtx, estr, "one/bright/day", false)
+	doDeleteNode(t, bobCtx, estr, "one/bright", true)
+	checkExists(t, rootCtx, estr, "one/bright", false)
 }
 
 func TestServerFormat(t *testing.T) {
 	server, estr := newMT(t, "")
 	defer server.Stop()
 
-	doMount(t, estr, "endpoint", naming.JoinAddressName(estr, "life/on/the/mississippi"), true, rootRT)
-	doMount(t, estr, "hostport", "/atrampabroad:8000", true, rootRT)
-	doMount(t, estr, "hostport-endpoint-platypus", "/@atrampabroad:8000@@", true, rootRT)
-	doMount(t, estr, "invalid/not/rooted", "atrampabroad:8000", false, rootRT)
-	doMount(t, estr, "invalid/no/port", "/atrampabroad", false, rootRT)
-	doMount(t, estr, "invalid/endpoint", "/@following the equator:8000@@@", false, rootRT)
+	doMount(t, rootCtx, estr, "endpoint", naming.JoinAddressName(estr, "life/on/the/mississippi"), true)
+	doMount(t, rootCtx, estr, "hostport", "/atrampabroad:8000", true)
+	doMount(t, rootCtx, estr, "hostport-endpoint-platypus", "/@atrampabroad:8000@@", true)
+	doMount(t, rootCtx, estr, "invalid/not/rooted", "atrampabroad:8000", false)
+	doMount(t, rootCtx, estr, "invalid/no/port", "/atrampabroad", false)
+	doMount(t, rootCtx, estr, "invalid/endpoint", "/@following the equator:8000@@@", false)
 }
 
 func TestExpiry(t *testing.T) {
@@ -588,21 +579,21 @@
 
 	ft := NewFakeTimeClock()
 	setServerListClock(ft)
-	doMount(t, estr, "a1/b1", collectionName, true, rootRT)
-	doMount(t, estr, "a1/b2", collectionName, true, rootRT)
-	doMount(t, estr, "a2/b1", collectionName, true, rootRT)
-	doMount(t, estr, "a2/b2/c", collectionName, true, rootRT)
+	doMount(t, rootCtx, estr, "a1/b1", collectionName, true)
+	doMount(t, rootCtx, estr, "a1/b2", collectionName, true)
+	doMount(t, rootCtx, estr, "a2/b1", collectionName, true)
+	doMount(t, rootCtx, estr, "a2/b2/c", collectionName, true)
 
-	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, estr, "", "*/b1/...", rootRT))
+	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, rootCtx, estr, "", "*/b1/..."))
 	ft.advance(time.Duration(ttlSecs/2) * time.Second)
-	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, estr, "", "*/b1/...", rootRT))
-	checkMatch(t, []string{"c"}, doGlob(t, estr, "a2/b2", "*", rootRT))
+	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, rootCtx, estr, "", "*/b1/..."))
+	checkMatch(t, []string{"c"}, doGlob(t, rootCtx, estr, "a2/b2", "*"))
 	// Refresh only a1/b1.  All the other mounts will expire upon the next
 	// ft advance.
-	doMount(t, estr, "a1/b1", collectionName, true, rootRT)
+	doMount(t, rootCtx, estr, "a1/b1", collectionName, true)
 	ft.advance(time.Duration(ttlSecs/2+4) * time.Second)
-	checkMatch(t, []string{"a1"}, doGlob(t, estr, "", "*", rootRT))
-	checkMatch(t, []string{"a1/b1"}, doGlob(t, estr, "", "*/b1/...", rootRT))
+	checkMatch(t, []string{"a1"}, doGlob(t, rootCtx, estr, "", "*"))
+	checkMatch(t, []string{"a1/b1"}, doGlob(t, rootCtx, estr, "", "*/b1/..."))
 }
 
 func TestBadACLs(t *testing.T) {
@@ -620,28 +611,32 @@
 	testutil.Init()
 	// Create the runtime for each of the three "processes"
 
+	var rootRT, aliceRT, bobRT veyron2.Runtime
 	var err error
 	if rootRT, err = rt.New(); err != nil {
 		panic(err)
 	}
+	rootCtx = rootRT.NewContext()
 	if aliceRT, err = rt.New(); err != nil {
 		panic(err)
 	}
+	aliceCtx = aliceRT.NewContext()
 	if bobRT, err = rt.New(); err != nil {
 		panic(err)
 	}
+	bobCtx = bobRT.NewContext()
 
 	// A hack to set the namespace roots to a value that won't work.
-	for _, r := range []veyron2.Runtime{rootRT, aliceRT, bobRT} {
-		r.Namespace().SetRoots()
+	for _, r := range []*context.T{rootCtx, aliceCtx, bobCtx} {
+		veyron2.GetNamespace(r).SetRoots()
 	}
 
 	// And setup their blessings so that they present "root", "alice" and "bob"
 	// and these blessings are recognized by the others.
 	principals := map[string]security.Principal{
-		"root":  rootRT.Principal(),
-		"alice": aliceRT.Principal(),
-		"bob":   bobRT.Principal(),
+		"root":  veyron2.GetPrincipal(rootCtx),
+		"alice": veyron2.GetPrincipal(aliceCtx),
+		"bob":   veyron2.GetPrincipal(bobCtx),
 	}
 	for name, p := range principals {
 		blessing, err := p.BlessSelf(name)
diff --git a/services/mounttable/lib/neighborhood_test.go b/services/mounttable/lib/neighborhood_test.go
index 0e48ee4..7b48e53 100644
--- a/services/mounttable/lib/neighborhood_test.go
+++ b/services/mounttable/lib/neighborhood_test.go
@@ -7,6 +7,7 @@
 	"testing"
 	"time"
 
+	"v.io/core/veyron2"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/options"
 	"v.io/core/veyron2/vlog"
@@ -27,7 +28,7 @@
 
 func TestNeighborhood(t *testing.T) {
 	vlog.Infof("TestNeighborhood")
-	server, err := rootRT.NewServer()
+	server, err := veyron2.NewServer(rootCtx)
 	if err != nil {
 		boom(t, "r.NewServer: %s", err)
 	}
@@ -61,7 +62,7 @@
 	// Wait for the mounttable to appear in mdns
 L:
 	for tries := 1; tries < 2; tries++ {
-		names := doGlob(t, estr, "", "*", rootRT)
+		names := doGlob(t, rootCtx, estr, "", "*")
 		t.Logf("names %v", names)
 		for _, n := range names {
 			if n == serverName {
@@ -72,17 +73,17 @@
 	}
 
 	// Make sure we get back a root for the server.
-	want, got := []string{""}, doGlob(t, estr, serverName, "", rootRT)
+	want, got := []string{""}, doGlob(t, rootCtx, estr, serverName, "")
 	if !reflect.DeepEqual(want, got) {
 		t.Errorf("Unexpected Glob result want: %q, got: %q", want, got)
 	}
 
 	// Make sure we can resolve through the neighborhood.
 	expectedSuffix := "a/b"
-	ctx := rootRT.NewContext()
-	client := rootRT.Client()
+
+	client := veyron2.GetClient(rootCtx)
 	name := naming.JoinAddressName(estr, serverName+"/"+expectedSuffix)
-	call, cerr := client.StartCall(ctx, name, "ResolveStepX", nil, options.NoResolve{})
+	call, cerr := client.StartCall(rootCtx, name, "ResolveStepX", nil, options.NoResolve{})
 	if cerr != nil {
 		boom(t, "ResolveStepX.StartCall: %s", cerr)
 	}
diff --git a/tools/mounttable/impl.go b/tools/mounttable/impl.go
index 067b27a..39bd34e 100644
--- a/tools/mounttable/impl.go
+++ b/tools/mounttable/impl.go
@@ -5,6 +5,7 @@
 	"fmt"
 	"time"
 
+	"v.io/core/veyron2"
 	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/naming"
@@ -39,7 +40,8 @@
 	ctx, cancel := context.WithTimeout(runtime.NewContext(), time.Minute)
 	defer cancel()
 	name, pattern := args[0], args[1]
-	call, err := runtime.Client().StartCall(ctx, name, ipc.GlobMethod, []interface{}{pattern}, options.NoResolve{})
+	client := veyron2.GetClient(ctx)
+	call, err := client.StartCall(ctx, name, ipc.GlobMethod, []interface{}{pattern}, options.NoResolve{})
 	if err != nil {
 		return err
 	}
@@ -100,7 +102,8 @@
 	}
 	ctx, cancel := context.WithTimeout(runtime.NewContext(), time.Minute)
 	defer cancel()
-	call, err := runtime.Client().StartCall(ctx, args[0], "Mount", []interface{}{args[1], seconds, 0}, options.NoResolve{})
+	client := veyron2.GetClient(ctx)
+	call, err := client.StartCall(ctx, args[0], "Mount", []interface{}{args[1], seconds, 0}, options.NoResolve{})
 	if err != nil {
 		return err
 	}
@@ -133,7 +136,8 @@
 	}
 	ctx, cancel := context.WithTimeout(runtime.NewContext(), time.Minute)
 	defer cancel()
-	call, err := runtime.Client().StartCall(ctx, args[0], "Unmount", []interface{}{args[1]}, options.NoResolve{})
+	client := veyron2.GetClient(ctx)
+	call, err := client.StartCall(ctx, args[0], "Unmount", []interface{}{args[1]}, options.NoResolve{})
 	if err != nil {
 		return err
 	}
@@ -165,7 +169,8 @@
 	}
 	ctx, cancel := context.WithTimeout(runtime.NewContext(), time.Minute)
 	defer cancel()
-	call, err := runtime.Client().StartCall(ctx, args[0], "ResolveStepX", []interface{}{}, options.NoResolve{})
+	client := veyron2.GetClient(ctx)
+	call, err := client.StartCall(ctx, args[0], "ResolveStepX", []interface{}{}, options.NoResolve{})
 	if err != nil {
 		return err
 	}
diff --git a/tools/principal/main.go b/tools/principal/main.go
index d849126..52551c0 100644
--- a/tools/principal/main.go
+++ b/tools/principal/main.go
@@ -243,7 +243,7 @@
 			if len(flagBlessRemoteKey) > 0 {
 				// Send blessings to a "server" started by a "recvblessings" command
 				granter := &granter{p, with, extension, caveats, flagBlessRemoteKey}
-				return sendBlessings(runtime, tobless, granter, flagBlessRemoteToken)
+				return sendBlessings(runtime.NewContext(), tobless, granter, flagBlessRemoteToken)
 			}
 			// Blessing a principal whose key is available locally.
 			var key security.PublicKey
@@ -935,8 +935,9 @@
 }
 func (*granter) IPCCallOpt() {}
 
-func sendBlessings(r veyron2.Runtime, object string, granter *granter, remoteToken string) error {
-	call, err := r.Client().StartCall(r.NewContext(), object, "Grant", []interface{}{remoteToken}, granter)
+func sendBlessings(ctx *context.T, object string, granter *granter, remoteToken string) error {
+	client := veyron2.GetClient(ctx)
+	call, err := client.StartCall(ctx, object, "Grant", []interface{}{remoteToken}, granter)
 	if err != nil {
 		return fmt.Errorf("failed to start RPC to %q: %v", object, err)
 	}
diff --git a/tools/vrpc/impl.go b/tools/vrpc/impl.go
index 041c189..8fc9a73 100644
--- a/tools/vrpc/impl.go
+++ b/tools/vrpc/impl.go
@@ -50,16 +50,9 @@
 	if len(args) != 1 {
 		return cmd.UsageErrorf("describe: incorrect number of arguments, expected 1, got %d", len(args))
 	}
-
-	client, err := setupClient(cmd, runtime)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
 	ctx, cancel := context.WithTimeout(runtime.NewContext(), time.Minute)
 	defer cancel()
-	signature, err := getSignature(ctx, cmd, args[0], client)
+	signature, err := getSignature(ctx, cmd, args[0])
 	if err != nil {
 		return err
 	}
@@ -89,15 +82,9 @@
 	}
 	server, method, args := args[0], args[1], args[2:]
 
-	client, err := setupClient(cmd, runtime)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
 	ctx, cancel := context.WithTimeout(runtime.NewContext(), time.Minute)
 	defer cancel()
-	signature, err := getSignature(ctx, cmd, server, client)
+	signature, err := getSignature(ctx, cmd, server)
 	if err != nil {
 		return fmt.Errorf("invoke: failed to get signature for %v: %v", server, err)
 	}
@@ -143,6 +130,7 @@
 	}
 
 	// Initiate the method invocation.
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, server, method, inputs)
 	if err != nil {
 		return fmt.Errorf("client.StartCall(%s, %q, %v) failed with %v", server, method, inputs, err)
@@ -199,15 +187,8 @@
 	}
 }
 
-func setupClient(cmd *cmdline.Command, r veyron2.Runtime) (ipc.Client, error) {
-	client, err := r.NewClient()
-	if err != nil {
-		return nil, fmt.Errorf("NewClient failed: %v", err)
-	}
-	return client, nil
-}
-
-func getSignature(ctx *context.T, cmd *cmdline.Command, server string, client ipc.Client) (ipc.ServiceSignature, error) {
+func getSignature(ctx *context.T, cmd *cmdline.Command, server string) (ipc.ServiceSignature, error) {
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, server, "Signature", nil)
 	if err != nil {
 		return ipc.ServiceSignature{}, fmt.Errorf("client.StartCall(%s, Signature, nil) failed with %v", server, err)
diff --git a/tools/vrun/vrun.go b/tools/vrun/vrun.go
index 294a739..a36de28 100644
--- a/tools/vrun/vrun.go
+++ b/tools/vrun/vrun.go
@@ -133,7 +133,7 @@
 		return nil, nil, err
 	}
 	syscall.CloseOnExec(fd)
-	principal, err := agent.NewAgentPrincipal(fd, runtime.NewContext())
+	principal, err := agent.NewAgentPrincipal(runtime.NewContext(), fd)
 	if err != nil {
 		vlog.Errorf("Couldn't connect to principal")
 		return nil, nil, err