core: Remove the NewClient and Client methods of Runtime.

This is part of the runtimeX migration.

Change-Id: Ie112d144854fbe498797a7e9545200614d144222
diff --git a/services/mgmt/application/impl/acl_test.go b/services/mgmt/application/impl/acl_test.go
index 9c0d6ab..0efba13 100644
--- a/services/mgmt/application/impl/acl_test.go
+++ b/services/mgmt/application/impl/acl_test.go
@@ -70,7 +70,7 @@
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
 	defer vlog.VI(1).Infof("%v terminating", publishName)
 	defer globalRT.Cleanup()
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	name := naming.JoinAddressName(endpoint, "")
@@ -91,29 +91,30 @@
 }
 
 func TestApplicationUpdateACL(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// setup mock up directory to put state in
 	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
 	defer cleanup()
 
-	selfRT := globalRT
 	otherRT := mgmttest.NewRuntime(t, globalRT)
 	defer otherRT.Cleanup()
+	otherCtx := otherRT.NewContext()
+
 	idp := tsecurity.NewIDProvider("root")
 
-	// By default, selfRT and otherRT will have blessings generated based on the
+	// By default, globalRT and otherRT will have blessings generated based on the
 	// username/machine name running this process. Since these blessings will appear
 	// in ACLs, give them recognizable names.
-	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(globalCtx), "self"); err != nil {
 		t.Fatal(err)
 	}
-	if err := idp.Bless(otherRT.Principal(), "other"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(otherCtx), "other"); err != nil {
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "repo")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "repo")
 	defer os.RemoveAll(crDir)
 
 	// Make server credentials derived from the test harness.
@@ -121,7 +122,8 @@
 	pid := mgmttest.ReadPID(t, nms)
 	defer syscall.Kill(pid, syscall.SIGINT)
 
-	otherStub := repository.ApplicationClient("repo/search/v1", otherRT.Client())
+	v1stub := repository.ApplicationClient("repo/search/v1")
+	repostub := repository.ApplicationClient("repo")
 
 	// Create example envelopes.
 	envelopeV1 := application.Envelope{
@@ -132,18 +134,16 @@
 
 	// Envelope putting as other should fail.
 	// TODO(rjkroege): Validate that it is failed with permission denied.
-	if err := otherStub.Put(otherRT.NewContext(), []string{"base"}, envelopeV1); err == nil {
+	if err := v1stub.Put(otherCtx, []string{"base"}, envelopeV1); err == nil {
 		t.Fatalf("Put() wrongly didn't fail")
 	}
 
-	// Envelope putting as self should succeed.
-	selfStub := repository.ApplicationClient("repo/search/v1", selfRT.Client())
-	if err := selfStub.Put(selfRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	// Envelope putting as global should succeed.
+	if err := v1stub.Put(globalCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
 
-	selfStub = repository.ApplicationClient("repo", selfRT.Client())
-	acl, etag, err := selfStub.GetACL(selfRT.NewContext())
+	acl, etag, err := repostub.GetACL(globalCtx)
 	if !verror.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("GetACL should have failed with ErrNotFound but was: %v", err)
 	}
@@ -160,11 +160,11 @@
 		newACL.Add("root/self", string(tag))
 		newACL.Add("root/other", string(tag))
 	}
-	if err := selfStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
+	if err := repostub.SetACL(globalCtx, newACL, ""); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
-	acl, etag, err = selfStub.GetACL(selfRT.NewContext())
+	acl, etag, err = repostub.GetACL(globalCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
@@ -174,28 +174,27 @@
 	}
 
 	// Envelope putting as other should now succeed.
-	if err := otherStub.Put(otherRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	if err := v1stub.Put(otherCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() wrongly failed: %v", err)
 	}
 
 	// Other takes control.
-	otherStub = repository.ApplicationClient("repo/", otherRT.Client())
-	acl, etag, err = otherStub.GetACL(otherRT.NewContext())
+	acl, etag, err = repostub.GetACL(otherCtx)
 	if err != nil {
 		t.Fatalf("GetACL 2 should not have failed: %v", err)
 	}
 	acl["Admin"] = access.ACL{
 		In:    []security.BlessingPattern{"root/other"},
 		NotIn: []string{}}
-	if err = otherStub.SetACL(otherRT.NewContext(), acl, etag); err != nil {
+	if err = repostub.SetACL(otherCtx, acl, etag); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
 	// Self is now locked out but other isn't.
-	if _, _, err = selfStub.GetACL(selfRT.NewContext()); err == nil {
+	if _, _, err = repostub.GetACL(globalCtx); err == nil {
 		t.Fatalf("GetACL should not have succeeded")
 	}
-	acl, _, err = otherStub.GetACL(otherRT.NewContext())
+	acl, _, err = repostub.GetACL(otherCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
@@ -222,29 +221,29 @@
 }
 
 func TestPerAppACL(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// setup mock up directory to put state in
 	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
 	defer cleanup()
 
-	selfRT := globalRT
 	otherRT := mgmttest.NewRuntime(t, globalRT)
 	defer otherRT.Cleanup()
+	otherCtx := otherRT.NewContext()
 	idp := tsecurity.NewIDProvider("root")
 
-	// By default, selfRT and otherRT will have blessings generated based on the
+	// By default, globalRT and otherRT will have blessings generated based on the
 	// username/machine name running this process. Since these blessings will appear
 	// in ACLs, give them recognizable names.
-	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(globalCtx), "self"); err != nil {
 		t.Fatal(err)
 	}
-	if err := idp.Bless(otherRT.Principal(), "other"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(otherCtx), "other"); err != nil {
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "repo")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "repo")
 	defer os.RemoveAll(crDir)
 
 	// Make a server with the same credential as test harness.
@@ -260,19 +259,19 @@
 	}
 
 	// Upload the envelope at two different names.
-	selfStub := repository.ApplicationClient("repo/search/v1", selfRT.Client())
-	if err := selfStub.Put(selfRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	v1stub := repository.ApplicationClient("repo/search/v1")
+	if err := v1stub.Put(globalCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
-	selfStub = repository.ApplicationClient("repo/search/v2", selfRT.Client())
-	if err := selfStub.Put(selfRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	v2stub := repository.ApplicationClient("repo/search/v2")
+	if err := v2stub.Put(globalCtx, []string{"base"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
 
 	// Self can access ACLs but other can't.
 	for _, path := range []string{"repo/search", "repo/search/v1", "repo/search/v2"} {
-		selfStub = repository.ApplicationClient(path, selfRT.Client())
-		acl, etag, err := selfStub.GetACL(selfRT.NewContext())
+		stub := repository.ApplicationClient(path)
+		acl, etag, err := stub.GetACL(globalCtx)
 		if !verror.Is(err, impl.ErrNotFound.ID) {
 			t.Fatalf("GetACL should have failed with ErrNotFound but was: %v", err)
 		}
@@ -282,26 +281,23 @@
 		if acl != nil {
 			t.Fatalf("GetACL got %v, expected %v", acl, nil)
 		}
-		otherStub := repository.ApplicationClient(path, otherRT.Client())
-		if _, _, err := otherStub.GetACL(otherRT.NewContext()); err == nil {
+		if _, _, err := stub.GetACL(otherCtx); err == nil {
 			t.Fatalf("GetACL didn't fail for other when it should have.")
 		}
 	}
 
 	// Self gives other full access only to repo/search/v1.
-	selfStub = repository.ApplicationClient("repo/search/v1", selfRT.Client())
 	newACL := make(access.TaggedACLMap)
 	for _, tag := range access.AllTypicalTags() {
 		newACL.Add("root/self", string(tag))
 		newACL.Add("root/other", string(tag))
 	}
-	if err := selfStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
+	if err := v1stub.SetACL(globalCtx, newACL, ""); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
 	// Other can now access this location.
-	otherStub := repository.ApplicationClient("repo/search/v1", otherRT.Client())
-	acl, _, err := otherStub.GetACL(otherRT.NewContext())
+	acl, _, err := v1stub.GetACL(otherCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
@@ -328,58 +324,54 @@
 
 	// But other locations should be unaffected and other cannot access.
 	for _, path := range []string{"repo/search", "repo/search/v2"} {
-		otherStub := repository.ApplicationClient(path, otherRT.Client())
-		if _, _, err := otherStub.GetACL(otherRT.NewContext()); err == nil {
+		stub := repository.ApplicationClient(path)
+		if _, _, err := stub.GetACL(otherCtx); err == nil {
 			t.Fatalf("GetACL didn't fail for other when it should have.")
 		}
 	}
 
 	// Self gives other write perms on base.
-	selfStub = repository.ApplicationClient("repo/", selfRT.Client())
+	repostub := repository.ApplicationClient("repo/")
 	newACL = make(access.TaggedACLMap)
 	for _, tag := range access.AllTypicalTags() {
 		newACL.Add("root/self", string(tag))
 	}
 	newACL["Write"] = access.ACL{In: []security.BlessingPattern{"root/other", "root/self"}}
-	if err := selfStub.SetACL(selfRT.NewContext(), newACL, ""); err != nil {
+	if err := repostub.SetACL(globalCtx, newACL, ""); err != nil {
 		t.Fatalf("SetACL failed: %v", err)
 	}
 
 	// Other can now upload an envelope at both locations.
-	for _, path := range []string{"repo/search/v1", "repo/search/v2"} {
-		otherStub = repository.ApplicationClient(path, otherRT.Client())
-		if err := otherStub.Put(otherRT.NewContext(), []string{"base"}, envelopeV1); err != nil {
+	for _, stub := range []repository.ApplicationClientStub{v1stub, v2stub} {
+		if err := stub.Put(otherCtx, []string{"base"}, envelopeV1); err != nil {
 			t.Fatalf("Put() failed: %v", err)
 		}
 	}
 
 	// But self didn't give other ACL modification permissions.
 	for _, path := range []string{"repo/search", "repo/search/v2"} {
-		otherStub := repository.ApplicationClient(path, otherRT.Client())
-		if _, _, err := otherStub.GetACL(otherRT.NewContext()); err == nil {
+		stub := repository.ApplicationClient(path)
+		if _, _, err := stub.GetACL(otherCtx); err == nil {
 			t.Fatalf("GetACL didn't fail for other when it should have.")
 		}
 	}
 }
 
 func TestInitialACLSet(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Setup mock up directory to put state in.
 	storedir, cleanup := mgmttest.SetupRootDir(t, "application")
 	defer cleanup()
 
-	selfRT := globalRT
-	otherRT := mgmttest.NewRuntime(t, globalRT)
-	defer otherRT.Cleanup()
 	idp := tsecurity.NewIDProvider("root")
 
 	// Make a recognizable principal name.
-	if err := idp.Bless(selfRT.Principal(), "self"); err != nil {
+	if err := idp.Bless(veyron2.GetPrincipal(globalCtx), "self"); err != nil {
 		t.Fatal(err)
 	}
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "repo")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "repo")
 	defer os.RemoveAll(crDir)
 
 	// Make an TAM for use on the command line.
@@ -402,8 +394,8 @@
 	defer syscall.Kill(pid, syscall.SIGINT)
 
 	// It should have the correct starting ACLs from the command line.
-	selfStub := repository.ApplicationClient("repo", selfRT.Client())
-	acl, _, err := selfStub.GetACL(selfRT.NewContext())
+	stub := repository.ApplicationClient("repo")
+	acl, _, err := stub.GetACL(globalCtx)
 	if err != nil {
 		t.Fatalf("GetACL should not have failed: %v", err)
 	}
diff --git a/services/mgmt/application/impl/impl_test.go b/services/mgmt/application/impl/impl_test.go
index 52a0dd1..f826e2f 100644
--- a/services/mgmt/application/impl/impl_test.go
+++ b/services/mgmt/application/impl/impl_test.go
@@ -20,8 +20,6 @@
 // TestInterface tests that the implementation correctly implements
 // the Application interface.
 func TestInterface(t *testing.T) {
-	ctx := globalRT.NewContext()
-
 	dir, prefix := "", ""
 	store, err := ioutil.TempDir(dir, prefix)
 	if err != nil {
@@ -33,7 +31,7 @@
 		t.Fatalf("impl.NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
@@ -58,43 +56,43 @@
 	}
 
 	// Test Put(), adding a number of application envelopes.
-	if err := stubV1.Put(ctx, []string{"base", "media"}, envelopeV1); err != nil {
+	if err := stubV1.Put(globalCtx, []string{"base", "media"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
-	if err := stubV2.Put(ctx, []string{"base"}, envelopeV2); err != nil {
+	if err := stubV2.Put(globalCtx, []string{"base"}, envelopeV2); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
-	if err := stub.Put(ctx, []string{"base", "media"}, envelopeV1); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
+	if err := stub.Put(globalCtx, []string{"base", "media"}, envelopeV1); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrInvalidSuffix, err)
 	}
 
 	// Test Match(), trying to retrieve both existing and non-existing
 	// application envelopes.
 	var output application.Envelope
-	if output, err = stubV2.Match(ctx, []string{"base", "media"}); err != nil {
+	if output, err = stubV2.Match(globalCtx, []string{"base", "media"}); err != nil {
 		t.Fatalf("Match() failed: %v", err)
 	}
 	if !reflect.DeepEqual(envelopeV2, output) {
 		t.Fatalf("Incorrect output: expected %v, got %v", envelopeV2, output)
 	}
-	if output, err = stubV1.Match(ctx, []string{"media"}); err != nil {
+	if output, err = stubV1.Match(globalCtx, []string{"media"}); err != nil {
 		t.Fatalf("Match() failed: %v", err)
 	}
 	if !reflect.DeepEqual(envelopeV1, output) {
 		t.Fatalf("Unexpected output: expected %v, got %v", envelopeV1, output)
 	}
-	if _, err := stubV2.Match(ctx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV2.Match(globalCtx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stubV2.Match(ctx, []string{}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV2.Match(globalCtx, []string{}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stub.Match(ctx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
+	if _, err := stub.Match(globalCtx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrInvalidSuffix.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrInvalidSuffix, err)
 	}
 
 	// Test Glob
-	matches, err := testutil.GlobName(ctx, naming.JoinAddressName(endpoint, ""), "...")
+	matches, err := testutil.GlobName(globalCtx, naming.JoinAddressName(endpoint, ""), "...")
 	if err != nil {
 		t.Errorf("Unexpected Glob error: %v", err)
 	}
@@ -110,34 +108,34 @@
 
 	// Test Remove(), trying to remove both existing and non-existing
 	// application envelopes.
-	if err := stubV1.Remove(ctx, "base"); err != nil {
+	if err := stubV1.Remove(globalCtx, "base"); err != nil {
 		t.Fatalf("Remove() failed: %v", err)
 	}
-	if output, err = stubV1.Match(ctx, []string{"media"}); err != nil {
+	if output, err = stubV1.Match(globalCtx, []string{"media"}); err != nil {
 		t.Fatalf("Match() failed: %v", err)
 	}
-	if err := stubV1.Remove(ctx, "base"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if err := stubV1.Remove(globalCtx, "base"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if err := stub.Remove(ctx, "base"); err != nil {
+	if err := stub.Remove(globalCtx, "base"); err != nil {
 		t.Fatalf("Remove() failed: %v", err)
 	}
-	if err := stubV2.Remove(ctx, "media"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if err := stubV2.Remove(globalCtx, "media"); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if err := stubV1.Remove(ctx, "media"); err != nil {
+	if err := stubV1.Remove(globalCtx, "media"); err != nil {
 		t.Fatalf("Remove() failed: %v", err)
 	}
 
 	// Finally, use Match() to test that Remove really removed the
 	// application envelopes.
-	if _, err := stubV1.Match(ctx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV1.Match(globalCtx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stubV1.Match(ctx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV1.Match(globalCtx, []string{"media"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
-	if _, err := stubV2.Match(ctx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
+	if _, err := stubV2.Match(globalCtx, []string{"base"}); err == nil || !verror2.Is(err, impl.ErrNotFound.ID) {
 		t.Fatalf("Unexpected error: expected %v, got %v", impl.ErrNotFound, err)
 	}
 
@@ -160,7 +158,7 @@
 		t.Fatalf("impl.NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
@@ -177,12 +175,12 @@
 		Binary: "/veyron/name/of/binary",
 	}
 
-	if err := stubV1.Put(globalRT.NewContext(), []string{"media"}, envelopeV1); err != nil {
+	if err := stubV1.Put(globalCtx, []string{"media"}, envelopeV1); err != nil {
 		t.Fatalf("Put() failed: %v", err)
 	}
 
 	// There is content here now.
-	output, err := stubV1.Match(globalRT.NewContext(), []string{"media"})
+	output, err := stubV1.Match(globalCtx, []string{"media"})
 	if err != nil {
 		t.Fatalf("Match(%v) failed: %v", "media", err)
 	}
@@ -198,7 +196,7 @@
 		t.Fatalf("impl.NewDispatcher() failed: %v", err)
 	}
 
-	server, endpoint = mgmttest.NewServer(globalRT)
+	server, endpoint = mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 
 	if err := server.ServeDispatcher("", dispatcher); err != nil {
@@ -207,7 +205,7 @@
 
 	stubV1 = repository.ApplicationClient(naming.JoinAddressName(endpoint, "search/v1"))
 
-	output, err = stubV1.Match(globalRT.NewContext(), []string{"media"})
+	output, err = stubV1.Match(globalCtx, []string{"media"})
 	if err != nil {
 		t.Fatalf("Match(%v) failed: %v", "media", err)
 	}
diff --git a/services/mgmt/device/deviced/commands.go b/services/mgmt/device/deviced/commands.go
index c151c8b..edf5e95 100644
--- a/services/mgmt/device/deviced/commands.go
+++ b/services/mgmt/device/deviced/commands.go
@@ -117,7 +117,7 @@
 		return err
 	}
 	defer runtime.Cleanup()
-	if err := impl.Stop(installationDir(), runtime); err != nil {
+	if err := impl.Stop(runtime.NewContext(), installationDir()); err != nil {
 		vlog.Errorf("Stop failed: %v", err)
 		return err
 	}
diff --git a/services/mgmt/device/impl/app_service.go b/services/mgmt/device/impl/app_service.go
index 00d8320..aebe580 100644
--- a/services/mgmt/device/impl/app_service.go
+++ b/services/mgmt/device/impl/app_service.go
@@ -460,10 +460,14 @@
 		// TODO(caprita): Part of the cleanup upon destroying an
 		// instance, we should tell the agent to drop the principal.
 		handle, conn, err := securityAgent.keyMgrAgent.NewPrincipal(ctx, false)
+		if err != nil {
+			vlog.Errorf("NewPrincipal() failed %v", err)
+			return verror2.Make(ErrOperationFailed, nil)
+		}
 		defer conn.Close()
 
 		// TODO(caprita): release the socket created by NewAgentPrincipal.
-		if p, err = agent.NewAgentPrincipal(int(conn.Fd()), ctx); err != nil {
+		if p, err = agent.NewAgentPrincipal(ctx, int(conn.Fd())); err != nil {
 			vlog.Errorf("NewAgentPrincipal() failed: %v", err)
 			return verror2.Make(ErrOperationFailed, nil)
 		}
diff --git a/services/mgmt/device/impl/device_installer.go b/services/mgmt/device/impl/device_installer.go
index 77f6397..15cf0ca 100644
--- a/services/mgmt/device/impl/device_installer.go
+++ b/services/mgmt/device/impl/device_installer.go
@@ -10,7 +10,7 @@
 	"regexp"
 	"strings"
 
-	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/services/mgmt/application"
 	"v.io/core/veyron2/services/mgmt/device"
 
@@ -191,13 +191,13 @@
 }
 
 // Stop stops the device manager.
-func Stop(installDir string, runtime veyron2.Runtime) error {
+func Stop(ctx *context.T, installDir string) error {
 	root := filepath.Join(installDir, dmRoot)
 	info, err := loadManagerInfo(filepath.Join(root, "device-manager"))
 	if err != nil {
 		return fmt.Errorf("loadManagerInfo failed: %v", err)
 	}
-	if err := device.ApplicationClient(info.MgrName).Stop(runtime.NewContext(), 5); err != nil {
+	if err := device.ApplicationClient(info.MgrName).Stop(ctx, 5); err != nil {
 		return fmt.Errorf("Stop failed: %v", err)
 	}
 	// TODO(caprita): Wait for the (device|agent) process to be gone.
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index d5c7242..838e1eb 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -85,7 +85,6 @@
 }
 
 var globalRT veyron2.Runtime
-
 var globalCtx *context.T
 
 func initRT(opts ...veyron2.ROpt) {
@@ -158,7 +157,7 @@
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
 	defer vlog.VI(1).Infof("%v terminating", publishName)
 	defer globalRT.Cleanup()
-	server, endpoint := mgmttest.NewServer(globalRT)
+	server, endpoint := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 	name := naming.JoinAddressName(endpoint, "")
 	vlog.VI(1).Infof("Device manager name: %v", name)
@@ -180,14 +179,14 @@
 		}
 		configState.Root, configState.Helper, configState.Origin, configState.CurrentLink = args[0], args[1], args[2], args[3]
 	}
-	dispatcher, err := impl.NewDispatcher(globalRT.Principal(), configState, func() { fmt.Println("stop handler") })
+	dispatcher, err := impl.NewDispatcher(veyron2.GetPrincipal(globalCtx), configState, func() { fmt.Println("stop handler") })
 	if err != nil {
 		vlog.Fatalf("Failed to create device manager dispatcher: %v", err)
 	}
 	if err := server.ServeDispatcher(publishName, dispatcher); err != nil {
 		vlog.Fatalf("Serve(%v) failed: %v", publishName, err)
 	}
-	impl.InvokeCallback(globalRT.NewContext(), name)
+	impl.InvokeCallback(globalCtx, name)
 
 	fmt.Fprintf(stdout, "ready:%d\n", os.Getpid())
 
@@ -223,7 +222,8 @@
 }
 
 func ping() {
-	if call, err := globalRT.Client().StartCall(globalRT.NewContext(), "pingserver", "Ping", []interface{}{os.Getenv(suidhelper.SavedArgs)}); err != nil {
+	client := veyron2.GetClient(globalCtx)
+	if call, err := client.StartCall(globalCtx, "pingserver", "Ping", []interface{}{os.Getenv(suidhelper.SavedArgs)}); err != nil {
 		vlog.Fatalf("StartCall failed: %v", err)
 	} else if err := call.Finish(); err != nil {
 		vlog.Fatalf("Finish failed: %v", err)
@@ -231,9 +231,10 @@
 }
 
 func cat(name, file string) (string, error) {
-	ctx, cancel := context.WithTimeout(globalRT.NewContext(), time.Minute)
+	ctx, cancel := context.WithTimeout(globalCtx, time.Minute)
 	defer cancel()
-	call, err := globalRT.Client().StartCall(ctx, name, "Cat", []interface{}{file})
+	client := veyron2.GetClient(globalCtx)
+	call, err := client.StartCall(ctx, name, "Cat", []interface{}{file})
 	if err != nil {
 		return "", err
 	}
@@ -252,7 +253,7 @@
 	publishName := args[0]
 
 	defer globalRT.Cleanup()
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 	if err := server.Serve(publishName, new(appService), nil); err != nil {
 		vlog.Fatalf("Serve(%v) failed: %v", publishName, err)
@@ -301,7 +302,7 @@
 // command. Further versions are started through the soft link that the device
 // manager itself updates.
 func TestDeviceManagerUpdateAndRevert(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -315,7 +316,7 @@
 	// convenient to put it there so we have everything in one place.
 	currLink := filepath.Join(root, "current_link")
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 	dmArgs := []string{"factoryDM", root, "unused_helper", mockApplicationRepoName, currLink}
 	args, env := sh.CommandEnvelope(deviceManagerCmd, crEnv, dmArgs...)
@@ -354,7 +355,7 @@
 	// Set up a second version of the device manager. The information in the
 	// envelope will be used by the device manager to stage the next
 	// version.
-	crDir, crEnv = mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv = mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v2DM")
 	updateDevice(t, "factoryDM")
@@ -397,7 +398,7 @@
 	}
 
 	// Create a third version of the device manager and issue an update.
-	crDir, crEnv = mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv = mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 	*envelope = envelopeFromShell(sh, crEnv, deviceManagerCmd, application.DeviceManagerTitle, "v3DM")
 	updateDevice(t, "v2DM")
@@ -478,7 +479,7 @@
 // returns a channel on which the app's ping message is returned, and a cleanup
 // function.
 func setupPingServer(t *testing.T) (<-chan string, func()) {
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	pingCh := make(chan string, 1)
 	if err := server.Serve("pingserver", pingServer(pingCh), &openAuthorizer{}); err != nil {
 		t.Fatalf("Serve(%q, <dispatcher>) failed: %v", "pingserver", err)
@@ -539,7 +540,7 @@
 // TestAppLifeCycle installs an app, starts it, suspends it, resumes it, and
 // then stops it.
 func TestAppLifeCycle(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -552,7 +553,7 @@
 	// Create a script wrapping the test target that implements suidhelper.
 	helperPath := generateSuidHelperScript(t, root)
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Set up the device manager.  Since we won't do device manager updates,
@@ -730,7 +731,7 @@
 	if err != nil {
 		t.Fatalf("binaryimpl.NewState failed: %v", err)
 	}
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	name := "realbin"
 	if err := server.ServeDispatcher(name, binaryimpl.NewDispatcher(state, nil)); err != nil {
 		t.Fatalf("server.ServeDispatcher failed: %v", err)
@@ -744,7 +745,7 @@
 	if err := ioutil.WriteFile(filepath.Join(tmpdir, "hello.txt"), []byte("Hello World!"), 0600); err != nil {
 		t.Fatalf("ioutil.WriteFile failed: %v", err)
 	}
-	if err := libbinary.UploadFromDir(globalRT.NewContext(), naming.Join(name, "testpkg"), tmpdir); err != nil {
+	if err := libbinary.UploadFromDir(globalCtx, naming.Join(name, "testpkg"), tmpdir); err != nil {
 		t.Fatalf("libbinary.UploadFromDir failed: %v", err)
 	}
 	return func() {
@@ -760,7 +761,7 @@
 // TestDeviceManagerClaim claims a devicemanager and tests ACL permissions on
 // its methods.
 func TestDeviceManagerClaim(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -770,7 +771,7 @@
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -832,7 +833,7 @@
 }
 
 func TestDeviceManagerUpdateACL(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -861,7 +862,7 @@
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Set up the device manager.  Since we won't do device manager updates,
@@ -942,7 +943,7 @@
 // This should bring up a functioning device manager.  In the end it runs
 // Uninstall and verifies that the installation is gone.
 func TestDeviceManagerInstallation(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 	testDir, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
@@ -974,7 +975,7 @@
 	revertDeviceExpectError(t, "dm", impl.ErrUpdateNoOp.ID) // No previous version available.
 
 	// Stop the device manager.
-	if err := impl.Stop(dmDir, globalRT); err != nil {
+	if err := impl.Stop(globalCtx, dmDir); err != nil {
 		t.Fatalf("Stop failed: %v", err)
 	}
 	dms.Expect("stop handler")
@@ -995,7 +996,7 @@
 }
 
 func TestDeviceManagerGlobAndDebug(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -1005,7 +1006,7 @@
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -1082,7 +1083,7 @@
 	logFileRemoveErrorFatalWarningRE := regexp.MustCompile("(ERROR|FATAL|WARNING)")
 	statsTrimRE := regexp.MustCompile("/stats/(ipc|system(/start-time.*)?)$")
 	for _, tc := range testcases {
-		results, err := testutil.GlobName(globalRT.NewContext(), tc.name, tc.pattern)
+		results, err := testutil.GlobName(globalCtx, tc.name, tc.pattern)
 		if err != nil {
 			t.Errorf("unexpected glob error for (%q, %q): %v", tc.name, tc.pattern, err)
 			continue
@@ -1110,7 +1111,7 @@
 	}
 
 	// Call Size() on the log file objects.
-	files, err := testutil.GlobName(globalRT.NewContext(), "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/logs/*")
+	files, err := testutil.GlobName(globalCtx, "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/logs/*")
 	if err != nil {
 		t.Errorf("unexpected glob error: %v", err)
 	}
@@ -1120,13 +1121,13 @@
 	for _, file := range files {
 		name := naming.Join("dm", file)
 		c := logreader.LogFileClient(name)
-		if _, err := c.Size(globalRT.NewContext()); err != nil {
+		if _, err := c.Size(globalCtx); err != nil {
 			t.Errorf("Size(%q) failed: %v", name, err)
 		}
 	}
 
 	// Call Value() on some of the stats objects.
-	objects, err := testutil.GlobName(globalRT.NewContext(), "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/stats/system/start-time*")
+	objects, err := testutil.GlobName(globalCtx, "dm", "apps/google naps/"+install1ID+"/"+instance1ID+"/stats/system/start-time*")
 	if err != nil {
 		t.Errorf("unexpected glob error: %v", err)
 	}
@@ -1136,7 +1137,7 @@
 	for _, obj := range objects {
 		name := naming.Join("dm", obj)
 		c := stats.StatsClient(name)
-		if _, err := c.Value(globalRT.NewContext()); err != nil {
+		if _, err := c.Value(globalCtx); err != nil {
 			t.Errorf("Value(%q) failed: %v", name, err)
 		}
 	}
@@ -1145,7 +1146,7 @@
 	{
 		name := "dm/apps/google naps/" + install1ID + "/" + instance1ID + "/pprof"
 		c := pprof.PProfClient(name)
-		v, err := c.CmdLine(globalRT.NewContext())
+		v, err := c.CmdLine(globalCtx)
 		if err != nil {
 			t.Errorf("CmdLine(%q) failed: %v", name, err)
 		}
@@ -1159,7 +1160,7 @@
 }
 
 func TestDeviceManagerPackages(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -1171,7 +1172,7 @@
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
 	defer cleanup()
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -1229,7 +1230,7 @@
 // TODO(rjkroege): Verify that associations persist across restarts once
 // permanent storage is added.
 func TestAccountAssociation(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	root, cleanup := mgmttest.SetupRootDir(t, "devicemanager")
@@ -1252,7 +1253,7 @@
 	if err := idp.Bless(otherRT.Principal(), "other"); err != nil {
 		t.Fatal(err)
 	}
-	crFile, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crFile, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crFile)
 
 	_, dms := mgmttest.RunShellCommand(t, sh, crEnv, deviceManagerCmd, "dm", root, "unused_helper", "unused_app_repo_name", "unused_curr_link")
@@ -1328,7 +1329,7 @@
 }
 
 func TestAppWithSuidHelper(t *testing.T) {
-	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalRT)
+	sh, deferFn := mgmttest.CreateShellAndMountTable(t, globalCtx)
 	defer deferFn()
 
 	// Set up mock application and binary repositories.
@@ -1357,7 +1358,7 @@
 		t.Fatal(err)
 	}
 
-	crDir, crEnv := mgmttest.CredentialsForChild(globalRT, "devicemanager")
+	crDir, crEnv := mgmttest.CredentialsForChild(globalCtx, "devicemanager")
 	defer os.RemoveAll(crDir)
 
 	// Create a script wrapping the test target that implements suidhelper.
@@ -1371,7 +1372,7 @@
 
 	// Create the local server that the app uses to tell us which system
 	// name the device manager wished to run it as.
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	defer server.Stop()
 	pingCh := make(chan string, 1)
 	if err := server.Serve("pingserver", pingServer(pingCh), nil); err != nil {
diff --git a/services/mgmt/device/impl/mock_repo_test.go b/services/mgmt/device/impl/mock_repo_test.go
index 82644a3..16fed19 100644
--- a/services/mgmt/device/impl/mock_repo_test.go
+++ b/services/mgmt/device/impl/mock_repo_test.go
@@ -37,7 +37,7 @@
 // repository.  It returns a pointer to the envelope that the repository returns
 // to clients (so that it can be changed).  It also returns a cleanup function.
 func startApplicationRepository() (*application.Envelope, func()) {
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	invoker := new(arInvoker)
 	name := mockApplicationRepoName
 	if err := server.Serve(name, repository.ApplicationServer(invoker), &openAuthorizer{}); err != nil {
@@ -82,7 +82,7 @@
 // startBinaryRepository sets up a server running the binary repository and
 // returns a cleanup function.
 func startBinaryRepository() func() {
-	server, _ := mgmttest.NewServer(globalRT)
+	server, _ := mgmttest.NewServer(globalCtx)
 	name := mockBinaryRepoName
 	if err := server.Serve(name, repository.BinaryServer(new(brInvoker)), &openAuthorizer{}); err != nil {
 		vlog.Fatalf("Serve(%q) failed: %v", name, err)
diff --git a/services/mgmt/device/impl/proxy_invoker.go b/services/mgmt/device/impl/proxy_invoker.go
index e08be24..506d57f 100644
--- a/services/mgmt/device/impl/proxy_invoker.go
+++ b/services/mgmt/device/impl/proxy_invoker.go
@@ -47,8 +47,10 @@
 	for i, ap := range argptrs {
 		args[i] = ap
 	}
-	runtime := veyron2.RuntimeFromContext(inCall.Context())
-	outCall, err := runtime.Client().StartCall(inCall.Context(), p.remote, method, args)
+	ctx := inCall.Context()
+	client := veyron2.GetClient(ctx)
+
+	outCall, err := client.StartCall(ctx, p.remote, method, args)
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/mgmt/lib/testutil/modules.go b/services/mgmt/lib/testutil/modules.go
index d9ec550..8b801e5 100644
--- a/services/mgmt/lib/testutil/modules.go
+++ b/services/mgmt/lib/testutil/modules.go
@@ -8,6 +8,7 @@
 	"testing"
 
 	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/rt"
 	"v.io/core/veyron2/vlog"
@@ -44,21 +45,22 @@
 }
 
 // CredentialsForChild creates credentials for a child process.
-func CredentialsForChild(rt veyron2.Runtime, blessing string) (string, []string) {
-	creds, _ := security.ForkCredentials(rt.Principal(), blessing)
+func CredentialsForChild(ctx *context.T, blessing string) (string, []string) {
+	creds, _ := security.ForkCredentials(veyron2.GetPrincipal(ctx), blessing)
 	return creds, []string{consts.VeyronCredentials + "=" + creds}
 }
 
 // SetNSRoots sets the roots for the local runtime's namespace.
-func SetNSRoots(t *testing.T, rt veyron2.Runtime, roots ...string) {
-	if err := rt.Namespace().SetRoots(roots...); err != nil {
+func SetNSRoots(t *testing.T, ctx *context.T, roots ...string) {
+	ns := veyron2.GetNamespace(ctx)
+	if err := ns.SetRoots(roots...); err != nil {
 		t.Fatalf(testutil.FormatLogLine(3, "SetRoots(%v) failed with %v", roots, err))
 	}
 }
 
 // CreateShellAndMountTable builds a new modules shell and its
 // associated mount table.
-func CreateShellAndMountTable(t *testing.T, rt veyron2.Runtime) (*modules.Shell, func()) {
+func CreateShellAndMountTable(t *testing.T, ctx *context.T) (*modules.Shell, func()) {
 	sh, err := modules.NewShell(nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
@@ -75,7 +77,8 @@
 
 	// TODO(caprita): Define a GetNamespaceRootsCommand in modules/core and
 	// use that?
-	oldNamespaceRoots := rt.Namespace().Roots()
+
+	oldNamespaceRoots := veyron2.GetNamespace(ctx).Roots()
 	fn := func() {
 		vlog.VI(1).Info("------------ CLEANUP ------------")
 		vlog.VI(1).Info("---------------------------------")
@@ -90,9 +93,9 @@
 		}
 		vlog.VI(1).Info("--(done shutting down root mt)---")
 		vlog.VI(1).Info("--------- DONE CLEANUP ----------")
-		SetNSRoots(t, rt, oldNamespaceRoots...)
+		SetNSRoots(t, ctx, oldNamespaceRoots...)
 	}
-	SetNSRoots(t, rt, mtName)
+	SetNSRoots(t, ctx, mtName)
 	sh.SetVar(consts.NamespaceRootPrefix, mtName)
 	return sh, fn
 }
@@ -110,8 +113,8 @@
 }
 
 // NewServer creates a new server.
-func NewServer(rt veyron2.Runtime) (ipc.Server, string) {
-	server, err := rt.NewServer()
+func NewServer(ctx *context.T) (ipc.Server, string) {
+	server, err := veyron2.NewServer(ctx)
 	if err != nil {
 		vlog.Fatalf("NewServer() failed: %v", err)
 	}
diff --git a/services/mounttable/lib/mounttable_test.go b/services/mounttable/lib/mounttable_test.go
index 4240970..3f4ab6a 100644
--- a/services/mounttable/lib/mounttable_test.go
+++ b/services/mounttable/lib/mounttable_test.go
@@ -11,6 +11,7 @@
 	"time"
 
 	"v.io/core/veyron2"
+	"v.io/core/veyron2/context"
 	"v.io/core/veyron2/ipc"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/options"
@@ -24,8 +25,8 @@
 )
 
 // Simulate different processes with different runtimes.
-// rootRT is the one running the mounttable service.
-var rootRT, aliceRT, bobRT veyron2.Runtime
+// rootCtx is the one running the mounttable service.
+var rootCtx, aliceCtx, bobCtx *context.T
 
 const ttlSecs = 60 * 60
 
@@ -34,10 +35,9 @@
 	t.Fatal(string(debug.Stack()))
 }
 
-func doMount(t *testing.T, ep, suffix, service string, shouldSucceed bool, as veyron2.Runtime) {
+func doMount(t *testing.T, ctx *context.T, ep, suffix, service string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Mount", []interface{}{service, uint32(ttlSecs), 0}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -59,10 +59,9 @@
 	}
 }
 
-func doUnmount(t *testing.T, ep, suffix, service string, shouldSucceed bool, as veyron2.Runtime) {
+func doUnmount(t *testing.T, ctx *context.T, ep, suffix, service string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Unmount", []interface{}{service}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -84,10 +83,9 @@
 	}
 }
 
-func doGetACL(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) (acl access.TaggedACLMap, etag string) {
+func doGetACL(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) (acl access.TaggedACLMap, etag string) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "GetACL", nil, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -110,10 +108,9 @@
 	return
 }
 
-func doSetACL(t *testing.T, ep, suffix string, acl access.TaggedACLMap, etag string, shouldSucceed bool, as veyron2.Runtime) {
+func doSetACL(t *testing.T, ctx *context.T, ep, suffix string, acl access.TaggedACLMap, etag string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "SetACL", []interface{}{acl, etag}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -136,10 +133,9 @@
 	return
 }
 
-func doDeleteNode(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) {
+func doDeleteNode(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Delete", []interface{}{false}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -161,10 +157,9 @@
 	}
 }
 
-func doDeleteSubtree(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) {
+func doDeleteSubtree(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "Delete", []interface{}{true}, options.NoResolve{})
 	if err != nil {
 		if !shouldSucceed {
@@ -187,10 +182,9 @@
 }
 
 // resolve assumes that the mount contains 0 or 1 servers.
-func resolve(name string, as veyron2.Runtime) (string, error) {
+func resolve(ctx *context.T, name string) (string, error) {
 	// Resolve the name one level.
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, "ResolveStepX", nil, options.NoResolve{})
 	if err != nil {
 		return "", err
@@ -205,15 +199,14 @@
 	return naming.JoinAddressName(entry.Servers[0].Server, entry.Name), nil
 }
 
-func export(t *testing.T, name, contents string, as veyron2.Runtime) {
+func export(t *testing.T, ctx *context.T, name, contents string) {
 	// Resolve the name.
-	resolved, err := resolve(name, as)
+	resolved, err := resolve(ctx, name)
 	if err != nil {
 		boom(t, "Failed to Export.Resolve %s: %s", name, err)
 	}
 	// Export the value.
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, resolved, "Export", []interface{}{contents, true}, options.NoResolve{})
 	if err != nil {
 		boom(t, "Failed to Export.StartCall %s to %s: %s", name, contents, err)
@@ -226,9 +219,9 @@
 	}
 }
 
-func checkContents(t *testing.T, name, expected string, shouldSucceed bool, as veyron2.Runtime) {
+func checkContents(t *testing.T, ctx *context.T, name, expected string, shouldSucceed bool) {
 	// Resolve the name.
-	resolved, err := resolve(name, as)
+	resolved, err := resolve(ctx, name)
 	if err != nil {
 		if !shouldSucceed {
 			return
@@ -236,8 +229,7 @@
 		boom(t, "Failed to Resolve %s: %s", name, err)
 	}
 	// Look up the value.
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, resolved, "Lookup", nil, options.NoResolve{})
 	if err != nil {
 		if shouldSucceed {
@@ -264,7 +256,7 @@
 }
 
 func newMT(t *testing.T, acl string) (ipc.Server, string) {
-	server, err := rootRT.NewServer(options.ServesMountTable(true))
+	server, err := veyron2.NewServer(rootCtx, options.ServesMountTable(true))
 	if err != nil {
 		boom(t, "r.NewServer: %s", err)
 	}
@@ -287,7 +279,7 @@
 }
 
 func newCollection(t *testing.T, acl string) (ipc.Server, string) {
-	server, err := rootRT.NewServer()
+	server, err := veyron2.NewServer(rootCtx)
 	if err != nil {
 		boom(t, "r.NewServer: %s", err)
 	}
@@ -317,81 +309,80 @@
 
 	// Mount the collection server into the mount table.
 	vlog.Infof("Mount the collection server into the mount table.")
-	doMount(t, mtAddr, "stuff", collectionName, true, rootRT)
+	doMount(t, rootCtx, mtAddr, "stuff", collectionName, true)
 
 	// Create a few objects and make sure we can read them.
 	vlog.Infof("Create a few objects.")
-	export(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", rootRT)
-	export(t, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain", rootRT)
-	export(t, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", rootRT)
+	export(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain")
+	export(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain")
+	export(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain")
 	vlog.Infof("Make sure we can read them.")
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "/stuff/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/nonexistant"), "falls mainly on the plain", false, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true, bobRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", false, aliceRT)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/in/spain"), "in spain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "/stuff/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/nonexistant"), "falls mainly on the plain", false)
+	checkContents(t, bobCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", true)
+	checkContents(t, aliceCtx, naming.JoinAddressName(mtAddr, "stuff/the/rain"), "the rain", false)
 
 	// Test multiple mounts.
 	vlog.Infof("Multiple mounts.")
-	doMount(t, mtAddr, "a/b", collectionName, true, rootRT)
-	doMount(t, mtAddr, "x/y", collectionName, true, rootRT)
-	doMount(t, mtAddr, "alpha//beta", collectionName, true, rootRT)
+	doMount(t, rootCtx, mtAddr, "a/b", collectionName, true)
+	doMount(t, rootCtx, mtAddr, "x/y", collectionName, true)
+	doMount(t, rootCtx, mtAddr, "alpha//beta", collectionName, true)
 	vlog.Infof("Make sure we can read them.")
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "x/y/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "alpha/beta/falls"), "falls mainly on the plain", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true, aliceRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false, bobRT)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuff/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "x/y/falls"), "falls mainly on the plain", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "alpha/beta/falls"), "falls mainly on the plain", true)
+	checkContents(t, aliceCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", true)
+	checkContents(t, bobCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false)
 
 	// Test getting/setting ACLs.
-	acl, etag := doGetACL(t, mtAddr, "stuff", true, rootRT)
-	doSetACL(t, mtAddr, "stuff", acl, "xyzzy", false, rootRT) // bad etag
-	doSetACL(t, mtAddr, "stuff", acl, etag, true, rootRT)     // good etag
-	_, netag := doGetACL(t, mtAddr, "stuff", true, rootRT)
+	acl, etag := doGetACL(t, rootCtx, mtAddr, "stuff", true)
+	doSetACL(t, rootCtx, mtAddr, "stuff", acl, "xyzzy", false) // bad etag
+	doSetACL(t, rootCtx, mtAddr, "stuff", acl, etag, true)     // good etag
+	_, netag := doGetACL(t, rootCtx, mtAddr, "stuff", true)
 	if netag == etag {
 		boom(t, "etag didn't change after SetACL: %s", netag)
 	}
-	doSetACL(t, mtAddr, "stuff", acl, "", true, rootRT) // no etag
+	doSetACL(t, rootCtx, mtAddr, "stuff", acl, "", true) // no etag
 
 	// Bob should be able to create nodes under the mounttable root but not alice.
-	doSetACL(t, mtAddr, "onlybob", acl, "", false, aliceRT)
-	doSetACL(t, mtAddr, "onlybob", acl, "", true, bobRT)
+	doSetACL(t, aliceCtx, mtAddr, "onlybob", acl, "", false)
+	doSetACL(t, bobCtx, mtAddr, "onlybob", acl, "", true)
 
 	// Test generic unmount.
 	vlog.Info("Test generic unmount.")
-	doUnmount(t, mtAddr, "a/b", "", true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false, rootRT)
+	doUnmount(t, rootCtx, mtAddr, "a/b", "", true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false)
 
 	// Test specific unmount.
 	vlog.Info("Test specific unmount.")
-	doMount(t, mtAddr, "a/b", collectionName, true, rootRT)
-	doUnmount(t, mtAddr, "a/b", collectionName, true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false, rootRT)
+	doMount(t, rootCtx, mtAddr, "a/b", collectionName, true)
+	doUnmount(t, rootCtx, mtAddr, "a/b", collectionName, true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "a/b/falls"), "falls mainly on the plain", false)
 
 	// Try timing out a mount.
 	vlog.Info("Try timing out a mount.")
 	ft := NewFakeTimeClock()
 	setServerListClock(ft)
-	doMount(t, mtAddr, "stuffWithTTL", collectionName, true, rootRT)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", true, rootRT)
+	doMount(t, rootCtx, mtAddr, "stuffWithTTL", collectionName, true)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", true)
 	ft.advance(time.Duration(ttlSecs+4) * time.Second)
-	checkContents(t, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", false, rootRT)
+	checkContents(t, rootCtx, naming.JoinAddressName(mtAddr, "stuffWithTTL/the/rain"), "the rain", false)
 
 	// Test unauthorized mount.
 	vlog.Info("Test unauthorized mount.")
-	doMount(t, mtAddr, "/a/b", collectionName, false, bobRT)
-	doMount(t, mtAddr, "/a/b", collectionName, false, aliceRT)
+	doMount(t, bobCtx, mtAddr, "/a/b", collectionName, false)
+	doMount(t, aliceCtx, mtAddr, "/a/b", collectionName, false)
 
-	doUnmount(t, mtAddr, "x/y", collectionName, false, bobRT)
+	doUnmount(t, bobCtx, mtAddr, "x/y", collectionName, false)
 }
 
-func doGlobX(t *testing.T, ep, suffix, pattern string, as veyron2.Runtime, joinServer bool) []string {
+func doGlobX(t *testing.T, ctx *context.T, ep, suffix, pattern string, joinServer bool) []string {
 	name := naming.JoinAddressName(ep, suffix)
-	ctx := as.NewContext()
-	client := as.Client()
+	client := veyron2.GetClient(ctx)
 	call, err := client.StartCall(ctx, name, ipc.GlobMethod, []interface{}{pattern}, options.NoResolve{})
 	if err != nil {
 		boom(t, "Glob.StartCall %s %s: %s", name, pattern, err)
@@ -421,8 +412,8 @@
 	return reply
 }
 
-func doGlob(t *testing.T, ep, suffix, pattern string, as veyron2.Runtime) []string {
-	return doGlobX(t, ep, suffix, pattern, as, false)
+func doGlob(t *testing.T, ctx *context.T, ep, suffix, pattern string) []string {
+	return doGlobX(t, ctx, ep, suffix, pattern, false)
 }
 
 // checkMatch verified that the two slices contain the same string items, albeit
@@ -439,8 +430,8 @@
 }
 
 // checkExists makes sure a name exists (or not).
-func checkExists(t *testing.T, ep, suffix string, shouldSucceed bool, as veyron2.Runtime) {
-	x := doGlobX(t, ep, "", suffix, as, false)
+func checkExists(t *testing.T, ctx *context.T, ep, suffix string, shouldSucceed bool) {
+	x := doGlobX(t, ctx, ep, "", suffix, false)
 	if len(x) != 1 || x[0] != suffix {
 		if shouldSucceed {
 			boom(t, "Failed to find %s", suffix)
@@ -458,9 +449,9 @@
 
 	// set up a mount space
 	fakeServer := naming.JoinAddressName(estr, "quux")
-	doMount(t, estr, "one/bright/day", fakeServer, true, rootRT)
-	doMount(t, estr, "in/the/middle", fakeServer, true, rootRT)
-	doMount(t, estr, "of/the/night", fakeServer, true, rootRT)
+	doMount(t, rootCtx, estr, "one/bright/day", fakeServer, true)
+	doMount(t, rootCtx, estr, "in/the/middle", fakeServer, true)
+	doMount(t, rootCtx, estr, "of/the/night", fakeServer, true)
 
 	// Try various globs.
 	tests := []struct {
@@ -478,14 +469,14 @@
 		{"", []string{""}},
 	}
 	for _, test := range tests {
-		out := doGlob(t, estr, "", test.in, rootRT)
+		out := doGlob(t, rootCtx, estr, "", test.in)
 		checkMatch(t, test.expected, out)
 	}
 
 	// Test Glob on a name that is under a mounted server. The result should the
 	// the address the mounted server with the extra suffix.
 	{
-		results := doGlobX(t, estr, "of/the/night/two/dead/boys/got/up/to/fight", "*", rootRT, true)
+		results := doGlobX(t, rootCtx, estr, "of/the/night/two/dead/boys/got/up/to/fight", "*", true)
 		if len(results) != 1 {
 			boom(t, "Unexpected number of results. Got %v, want 1", len(results))
 		}
@@ -502,14 +493,14 @@
 	fakeServer := naming.JoinAddressName(estr, "quux")
 
 	// Noone should be able to mount on someone else's names.
-	doMount(t, estr, "users/ted", fakeServer, false, aliceRT)
-	doMount(t, estr, "users/carol", fakeServer, false, bobRT)
-	doMount(t, estr, "users/george", fakeServer, false, rootRT)
+	doMount(t, aliceCtx, estr, "users/ted", fakeServer, false)
+	doMount(t, bobCtx, estr, "users/carol", fakeServer, false)
+	doMount(t, rootCtx, estr, "users/george", fakeServer, false)
 
 	// Anyone should be able to mount on their own names.
-	doMount(t, estr, "users/alice", fakeServer, true, aliceRT)
-	doMount(t, estr, "users/bob", fakeServer, true, bobRT)
-	doMount(t, estr, "users/root", fakeServer, true, rootRT)
+	doMount(t, aliceCtx, estr, "users/alice", fakeServer, true)
+	doMount(t, bobCtx, estr, "users/bob", fakeServer, true)
+	doMount(t, rootCtx, estr, "users/root", fakeServer, true)
 }
 
 func TestGlobACLs(t *testing.T) {
@@ -518,26 +509,26 @@
 
 	// set up a mount space
 	fakeServer := naming.JoinAddressName(estr, "quux")
-	doMount(t, estr, "one/bright/day", fakeServer, false, aliceRT) // Fails because alice can't mount there.
-	doMount(t, estr, "one/bright/day", fakeServer, true, bobRT)
-	doMount(t, estr, "a/b/c", fakeServer, true, rootRT)
+	doMount(t, aliceCtx, estr, "one/bright/day", fakeServer, false) // Fails because alice can't mount there.
+	doMount(t, bobCtx, estr, "one/bright/day", fakeServer, true)
+	doMount(t, rootCtx, estr, "a/b/c", fakeServer, true)
 
 	// Try various globs.
 	tests := []struct {
-		as       veyron2.Runtime
+		ctx      *context.T
 		in       string
 		expected []string
 	}{
-		{rootRT, "*", []string{"one", "a", "stuff", "users"}},
-		{aliceRT, "*", []string{"one", "a", "users"}},
-		{bobRT, "*", []string{"one", "stuff", "users"}},
+		{rootCtx, "*", []string{"one", "a", "stuff", "users"}},
+		{aliceCtx, "*", []string{"one", "a", "users"}},
+		{bobCtx, "*", []string{"one", "stuff", "users"}},
 		// bob, alice, and root have different visibility to the space.
-		{rootRT, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "stuff", "users"}},
-		{aliceRT, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "users"}},
-		{bobRT, "*/...", []string{"one", "one/bright", "one/bright/day", "stuff", "users"}},
+		{rootCtx, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "stuff", "users"}},
+		{aliceCtx, "*/...", []string{"one", "a", "one/bright", "a/b", "one/bright/day", "a/b/c", "users"}},
+		{bobCtx, "*/...", []string{"one", "one/bright", "one/bright/day", "stuff", "users"}},
 	}
 	for _, test := range tests {
-		out := doGlob(t, estr, "", test.in, test.as)
+		out := doGlob(t, test.ctx, estr, "", test.in)
 		checkMatch(t, test.expected, out)
 	}
 }
@@ -548,34 +539,34 @@
 
 	// set up a mount space
 	fakeServer := naming.JoinAddressName(estr, "quux")
-	doMount(t, estr, "one/bright/day", fakeServer, true, bobRT)
-	doMount(t, estr, "a/b/c", fakeServer, true, rootRT)
+	doMount(t, bobCtx, estr, "one/bright/day", fakeServer, true)
+	doMount(t, rootCtx, estr, "a/b/c", fakeServer, true)
 
 	// It shouldn't be possible to delete anything with children unless explicitly requested.
-	doDeleteNode(t, estr, "a/b", false, rootRT)
-	checkExists(t, estr, "a/b", true, rootRT)
-	doDeleteSubtree(t, estr, "a/b", true, rootRT)
-	checkExists(t, estr, "a/b", false, rootRT)
+	doDeleteNode(t, rootCtx, estr, "a/b", false)
+	checkExists(t, rootCtx, estr, "a/b", true)
+	doDeleteSubtree(t, rootCtx, estr, "a/b", true)
+	checkExists(t, rootCtx, estr, "a/b", false)
 
 	// Alice shouldn't be able to delete what bob created but bob and root should.
-	doDeleteNode(t, estr, "one/bright/day", false, aliceRT)
-	checkExists(t, estr, "one/bright/day", true, rootRT)
-	doDeleteNode(t, estr, "one/bright/day", true, rootRT)
-	checkExists(t, estr, "one/bright/day", false, rootRT)
-	doDeleteNode(t, estr, "one/bright", true, bobRT)
-	checkExists(t, estr, "one/bright", false, rootRT)
+	doDeleteNode(t, aliceCtx, estr, "one/bright/day", false)
+	checkExists(t, rootCtx, estr, "one/bright/day", true)
+	doDeleteNode(t, rootCtx, estr, "one/bright/day", true)
+	checkExists(t, rootCtx, estr, "one/bright/day", false)
+	doDeleteNode(t, bobCtx, estr, "one/bright", true)
+	checkExists(t, rootCtx, estr, "one/bright", false)
 }
 
 func TestServerFormat(t *testing.T) {
 	server, estr := newMT(t, "")
 	defer server.Stop()
 
-	doMount(t, estr, "endpoint", naming.JoinAddressName(estr, "life/on/the/mississippi"), true, rootRT)
-	doMount(t, estr, "hostport", "/atrampabroad:8000", true, rootRT)
-	doMount(t, estr, "hostport-endpoint-platypus", "/@atrampabroad:8000@@", true, rootRT)
-	doMount(t, estr, "invalid/not/rooted", "atrampabroad:8000", false, rootRT)
-	doMount(t, estr, "invalid/no/port", "/atrampabroad", false, rootRT)
-	doMount(t, estr, "invalid/endpoint", "/@following the equator:8000@@@", false, rootRT)
+	doMount(t, rootCtx, estr, "endpoint", naming.JoinAddressName(estr, "life/on/the/mississippi"), true)
+	doMount(t, rootCtx, estr, "hostport", "/atrampabroad:8000", true)
+	doMount(t, rootCtx, estr, "hostport-endpoint-platypus", "/@atrampabroad:8000@@", true)
+	doMount(t, rootCtx, estr, "invalid/not/rooted", "atrampabroad:8000", false)
+	doMount(t, rootCtx, estr, "invalid/no/port", "/atrampabroad", false)
+	doMount(t, rootCtx, estr, "invalid/endpoint", "/@following the equator:8000@@@", false)
 }
 
 func TestExpiry(t *testing.T) {
@@ -588,21 +579,21 @@
 
 	ft := NewFakeTimeClock()
 	setServerListClock(ft)
-	doMount(t, estr, "a1/b1", collectionName, true, rootRT)
-	doMount(t, estr, "a1/b2", collectionName, true, rootRT)
-	doMount(t, estr, "a2/b1", collectionName, true, rootRT)
-	doMount(t, estr, "a2/b2/c", collectionName, true, rootRT)
+	doMount(t, rootCtx, estr, "a1/b1", collectionName, true)
+	doMount(t, rootCtx, estr, "a1/b2", collectionName, true)
+	doMount(t, rootCtx, estr, "a2/b1", collectionName, true)
+	doMount(t, rootCtx, estr, "a2/b2/c", collectionName, true)
 
-	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, estr, "", "*/b1/...", rootRT))
+	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, rootCtx, estr, "", "*/b1/..."))
 	ft.advance(time.Duration(ttlSecs/2) * time.Second)
-	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, estr, "", "*/b1/...", rootRT))
-	checkMatch(t, []string{"c"}, doGlob(t, estr, "a2/b2", "*", rootRT))
+	checkMatch(t, []string{"a1/b1", "a2/b1"}, doGlob(t, rootCtx, estr, "", "*/b1/..."))
+	checkMatch(t, []string{"c"}, doGlob(t, rootCtx, estr, "a2/b2", "*"))
 	// Refresh only a1/b1.  All the other mounts will expire upon the next
 	// ft advance.
-	doMount(t, estr, "a1/b1", collectionName, true, rootRT)
+	doMount(t, rootCtx, estr, "a1/b1", collectionName, true)
 	ft.advance(time.Duration(ttlSecs/2+4) * time.Second)
-	checkMatch(t, []string{"a1"}, doGlob(t, estr, "", "*", rootRT))
-	checkMatch(t, []string{"a1/b1"}, doGlob(t, estr, "", "*/b1/...", rootRT))
+	checkMatch(t, []string{"a1"}, doGlob(t, rootCtx, estr, "", "*"))
+	checkMatch(t, []string{"a1/b1"}, doGlob(t, rootCtx, estr, "", "*/b1/..."))
 }
 
 func TestBadACLs(t *testing.T) {
@@ -620,28 +611,32 @@
 	testutil.Init()
 	// Create the runtime for each of the three "processes"
 
+	var rootRT, aliceRT, bobRT veyron2.Runtime
 	var err error
 	if rootRT, err = rt.New(); err != nil {
 		panic(err)
 	}
+	rootCtx = rootRT.NewContext()
 	if aliceRT, err = rt.New(); err != nil {
 		panic(err)
 	}
+	aliceCtx = aliceRT.NewContext()
 	if bobRT, err = rt.New(); err != nil {
 		panic(err)
 	}
+	bobCtx = bobRT.NewContext()
 
 	// A hack to set the namespace roots to a value that won't work.
-	for _, r := range []veyron2.Runtime{rootRT, aliceRT, bobRT} {
-		r.Namespace().SetRoots()
+	for _, r := range []*context.T{rootCtx, aliceCtx, bobCtx} {
+		veyron2.GetNamespace(r).SetRoots()
 	}
 
 	// And setup their blessings so that they present "root", "alice" and "bob"
 	// and these blessings are recognized by the others.
 	principals := map[string]security.Principal{
-		"root":  rootRT.Principal(),
-		"alice": aliceRT.Principal(),
-		"bob":   bobRT.Principal(),
+		"root":  veyron2.GetPrincipal(rootCtx),
+		"alice": veyron2.GetPrincipal(aliceCtx),
+		"bob":   veyron2.GetPrincipal(bobCtx),
 	}
 	for name, p := range principals {
 		blessing, err := p.BlessSelf(name)
diff --git a/services/mounttable/lib/neighborhood_test.go b/services/mounttable/lib/neighborhood_test.go
index 0e48ee4..7b48e53 100644
--- a/services/mounttable/lib/neighborhood_test.go
+++ b/services/mounttable/lib/neighborhood_test.go
@@ -7,6 +7,7 @@
 	"testing"
 	"time"
 
+	"v.io/core/veyron2"
 	"v.io/core/veyron2/naming"
 	"v.io/core/veyron2/options"
 	"v.io/core/veyron2/vlog"
@@ -27,7 +28,7 @@
 
 func TestNeighborhood(t *testing.T) {
 	vlog.Infof("TestNeighborhood")
-	server, err := rootRT.NewServer()
+	server, err := veyron2.NewServer(rootCtx)
 	if err != nil {
 		boom(t, "r.NewServer: %s", err)
 	}
@@ -61,7 +62,7 @@
 	// Wait for the mounttable to appear in mdns
 L:
 	for tries := 1; tries < 2; tries++ {
-		names := doGlob(t, estr, "", "*", rootRT)
+		names := doGlob(t, rootCtx, estr, "", "*")
 		t.Logf("names %v", names)
 		for _, n := range names {
 			if n == serverName {
@@ -72,17 +73,17 @@
 	}
 
 	// Make sure we get back a root for the server.
-	want, got := []string{""}, doGlob(t, estr, serverName, "", rootRT)
+	want, got := []string{""}, doGlob(t, rootCtx, estr, serverName, "")
 	if !reflect.DeepEqual(want, got) {
 		t.Errorf("Unexpected Glob result want: %q, got: %q", want, got)
 	}
 
 	// Make sure we can resolve through the neighborhood.
 	expectedSuffix := "a/b"
-	ctx := rootRT.NewContext()
-	client := rootRT.Client()
+
+	client := veyron2.GetClient(rootCtx)
 	name := naming.JoinAddressName(estr, serverName+"/"+expectedSuffix)
-	call, cerr := client.StartCall(ctx, name, "ResolveStepX", nil, options.NoResolve{})
+	call, cerr := client.StartCall(rootCtx, name, "ResolveStepX", nil, options.NoResolve{})
 	if cerr != nil {
 		boom(t, "ResolveStepX.StartCall: %s", cerr)
 	}