Merge "ref: Implement the javascript server side of vtrace."
diff --git a/cmd/application/impl_test.go b/cmd/application/impl_test.go
index c7a3cf8..2594b3f 100644
--- a/cmd/application/impl_test.go
+++ b/cmd/application/impl_test.go
@@ -16,9 +16,9 @@
 	"v.io/v23/services/security/access"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/mgmt/repository"
+	"v.io/x/ref/test"
 )
 
 var (
@@ -138,7 +138,7 @@
 
 func TestApplicationClient(t *testing.T) {
 	var shutdown v23.Shutdown
-	gctx, shutdown = testutil.InitForTest()
+	gctx, shutdown = test.InitForTest()
 	defer shutdown()
 
 	server, endpoint, err := startServer(t, gctx)
diff --git a/cmd/binary/impl_test.go b/cmd/binary/impl_test.go
index e6f99b1..43e4c42 100644
--- a/cmd/binary/impl_test.go
+++ b/cmd/binary/impl_test.go
@@ -21,8 +21,8 @@
 	"v.io/v23/services/security/access"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 type server struct {
@@ -121,7 +121,7 @@
 
 func TestBinaryClient(t *testing.T) {
 	var shutdown v23.Shutdown
-	gctx, shutdown = testutil.InitForTest()
+	gctx, shutdown = test.InitForTest()
 	defer shutdown()
 
 	server, endpoint, err := startServer(t, gctx)
diff --git a/cmd/build/impl_test.go b/cmd/build/impl_test.go
index 347ceca..a05930b 100644
--- a/cmd/build/impl_test.go
+++ b/cmd/build/impl_test.go
@@ -14,8 +14,8 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 type mock struct{}
@@ -64,7 +64,7 @@
 
 func TestBuildClient(t *testing.T) {
 	var shutdown v23.Shutdown
-	gctx, shutdown = testutil.InitForTest()
+	gctx, shutdown = test.InitForTest()
 	defer shutdown()
 
 	server, endpoint := startServer(gctx, t)
diff --git a/cmd/debug/debug_v23_test.go b/cmd/debug/debug_v23_test.go
index 600eb58..6e66711 100644
--- a/cmd/debug/debug_v23_test.go
+++ b/cmd/debug/debug_v23_test.go
@@ -10,7 +10,7 @@
 	"strings"
 	"time"
 
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/cmd/debug/v23_test.go b/cmd/debug/v23_test.go
index b3cf055..b9cd380 100644
--- a/cmd/debug/v23_test.go
+++ b/cmd/debug/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/cmd/mgmt/device/impl/devicemanager_mock_test.go b/cmd/mgmt/device/impl/devicemanager_mock_test.go
index 8afa66c..643d503 100644
--- a/cmd/mgmt/device/impl/devicemanager_mock_test.go
+++ b/cmd/mgmt/device/impl/devicemanager_mock_test.go
@@ -207,14 +207,17 @@
 func (i *mockDeviceInvoker) Revert(call ipc.ServerCall) error { return nil }
 
 type StartResponse struct {
-	appIds []string
-	err    error
+	err  error
+	msgs []device.StartServerMessage
 }
 
-func (mni *mockDeviceInvoker) Start(ipc.ServerCall) ([]string, error) {
+func (mni *mockDeviceInvoker) Start(call ipc.StreamServerCall) error {
 	ir := mni.tape.Record("Start")
 	r := ir.(StartResponse)
-	return r.appIds, r.err
+	for _, m := range r.msgs {
+		call.Send(m)
+	}
+	return r.err
 }
 
 type StopStimulus struct {
diff --git a/cmd/mgmt/device/impl/impl.go b/cmd/mgmt/device/impl/impl.go
index 48c4ede..30f332d 100644
--- a/cmd/mgmt/device/impl/impl.go
+++ b/cmd/mgmt/device/impl/impl.go
@@ -6,6 +6,7 @@
 	"fmt"
 
 	"v.io/v23"
+	"v.io/v23/context"
 	"v.io/v23/ipc"
 	"v.io/v23/naming"
 	"v.io/v23/options"
@@ -134,11 +135,38 @@
 		return cmd.UsageErrorf("start: incorrect number of arguments, expected %d, got %d", expected, got)
 	}
 	appInstallation, grant := args[0], args[1]
-	principal := v23.GetPrincipal(gctx)
-	appInstanceIDs, err := device.ApplicationClient(appInstallation).Start(gctx, &granter{p: principal, extension: grant})
+
+	ctx, cancel := context.WithCancel(gctx)
+	defer cancel()
+	principal := v23.GetPrincipal(ctx)
+
+	call, err := device.ApplicationClient(appInstallation).Start(ctx)
 	if err != nil {
 		return fmt.Errorf("Start failed: %v", err)
 	}
+	var appInstanceIDs []string
+	for call.RecvStream().Advance() {
+		switch msg := call.RecvStream().Value().(type) {
+		case device.StartServerMessageInstanceName:
+			appInstanceIDs = append(appInstanceIDs, msg.Value)
+		case device.StartServerMessageInstancePublicKey:
+			pubKey, err := security.UnmarshalPublicKey(msg.Value)
+			if err != nil {
+				return fmt.Errorf("Start failed: %v", err)
+			}
+			// TODO(caprita,rthellend): Get rid of security.UnconstrainedUse().
+			blessings, err := principal.Bless(pubKey, principal.BlessingStore().Default(), grant, security.UnconstrainedUse())
+			if err != nil {
+				return fmt.Errorf("Start failed: %v", err)
+			}
+			call.SendStream().Send(device.StartClientMessageAppBlessings{blessings})
+		default:
+			fmt.Fprintf(cmd.Stderr(), "Received unexpected message: %#v\n", msg)
+		}
+	}
+	if err := call.Finish(); err != nil {
+		return fmt.Errorf("Start failed: %v", err)
+	}
 	for _, id := range appInstanceIDs {
 		fmt.Fprintf(cmd.Stdout(), "Successfully started: %q\n", naming.Join(appInstallation, id))
 	}
diff --git a/cmd/mgmt/device/impl/impl_test.go b/cmd/mgmt/device/impl/impl_test.go
index 247c40e..ba6baa5 100644
--- a/cmd/mgmt/device/impl/impl_test.go
+++ b/cmd/mgmt/device/impl/impl_test.go
@@ -415,8 +415,11 @@
 
 	// Correct operation.
 	tape.SetResponses([]interface{}{StartResponse{
-		appIds: []string{"app1", "app2"},
-		err:    nil,
+		err: nil,
+		msgs: []device.StartServerMessage{
+			device.StartServerMessageInstanceName{"app1"},
+			device.StartServerMessageInstanceName{"app2"},
+		},
 	},
 	})
 	if err := cmd.Execute([]string{"start", appName, "grant"}); err != nil {
@@ -440,8 +443,8 @@
 
 	// Error operation.
 	tape.SetResponses([]interface{}{StartResponse{
-		[]string{},
 		verror.New(errOops, nil),
+		nil,
 	},
 	})
 	if err := cmd.Execute([]string{"start", appName, "grant"}); err == nil {
diff --git a/cmd/mgmt/device/impl/util_test.go b/cmd/mgmt/device/impl/util_test.go
index 1914614..06e0b51 100644
--- a/cmd/mgmt/device/impl/util_test.go
+++ b/cmd/mgmt/device/impl/util_test.go
@@ -5,15 +5,15 @@
 	"v.io/v23/context"
 
 	"v.io/x/ref/cmd/mgmt/device/impl"
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 var gctx *context.T
 
 func initTest() v23.Shutdown {
 	var shutdown v23.Shutdown
-	gctx, shutdown = testutil.InitForTest()
+	gctx, shutdown = test.InitForTest()
 	impl.SetGlobalContext(gctx)
 	return func() {
 		shutdown()
diff --git a/cmd/mgmt/mgmt_v23_test.go b/cmd/mgmt/mgmt_v23_test.go
index 7226894..9e00043 100644
--- a/cmd/mgmt/mgmt_v23_test.go
+++ b/cmd/mgmt/mgmt_v23_test.go
@@ -35,8 +35,8 @@
 	"time"
 
 	"v.io/v23/security"
-	"v.io/x/ref/lib/testutil/v23tests"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test/v23tests"
 )
 
 var (
diff --git a/cmd/mgmt/v23_test.go b/cmd/mgmt/v23_test.go
index 7f45d21..720176d 100644
--- a/cmd/mgmt/v23_test.go
+++ b/cmd/mgmt/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/cmd/mounttable/impl_test.go b/cmd/mounttable/impl_test.go
index a57b949..b3d7353 100644
--- a/cmd/mounttable/impl_test.go
+++ b/cmd/mounttable/impl_test.go
@@ -14,8 +14,8 @@
 	"v.io/v23/services/security/access"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 type server struct {
@@ -108,7 +108,7 @@
 
 func TestMountTableClient(t *testing.T) {
 	var shutdown v23.Shutdown
-	gctx, shutdown = testutil.InitForTest()
+	gctx, shutdown = test.InitForTest()
 	defer shutdown()
 
 	server, endpoint, err := startServer(t, gctx)
diff --git a/cmd/naming/simulator/commands.go b/cmd/naming/simulator/commands.go
index 30642b2..0b25d5d 100644
--- a/cmd/naming/simulator/commands.go
+++ b/cmd/naming/simulator/commands.go
@@ -9,7 +9,7 @@
 	"regexp"
 	"strings"
 
-	"v.io/x/ref/lib/modules"
+	"v.io/x/ref/test/modules"
 )
 
 type builtinCmd func(sh *modules.Shell, state *cmdState, args ...string) (string, error)
diff --git a/cmd/naming/simulator/driver.go b/cmd/naming/simulator/driver.go
index ec5fbce..0ba2f2a 100644
--- a/cmd/naming/simulator/driver.go
+++ b/cmd/naming/simulator/driver.go
@@ -3,7 +3,7 @@
 // structured as an interpreter, with global variables and variable
 // expansion, but no control flow. The command set that it supports is
 // extendable by adding new 'commands' that implement the API defined
-// by veyron/lib/modules.
+// by veyron/test/modules.
 package main
 
 import (
@@ -19,10 +19,10 @@
 	"v.io/v23"
 	"v.io/v23/context"
 
-	"v.io/x/ref/lib/modules"
-	_ "v.io/x/ref/lib/modules/core"
-	"v.io/x/ref/lib/testutil/expect"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	_ "v.io/x/ref/test/modules/core"
 )
 
 type cmdState struct {
diff --git a/cmd/naming/simulator/driver_test.go b/cmd/naming/simulator/driver_test.go
index f788ddd..bb298ff 100644
--- a/cmd/naming/simulator/driver_test.go
+++ b/cmd/naming/simulator/driver_test.go
@@ -5,7 +5,7 @@
 	"reflect"
 	"testing"
 
-	"v.io/x/ref/lib/modules"
+	"v.io/x/ref/test/modules"
 )
 
 func TestFields(t *testing.T) {
diff --git a/cmd/naming/simulator/shell_functions.go b/cmd/naming/simulator/shell_functions.go
index 935b362..1c2fc57 100644
--- a/cmd/naming/simulator/shell_functions.go
+++ b/cmd/naming/simulator/shell_functions.go
@@ -9,7 +9,7 @@
 	"v.io/v23/context"
 	"v.io/v23/naming"
 
-	"v.io/x/ref/lib/modules"
+	"v.io/x/ref/test/modules"
 )
 
 func init() {
diff --git a/cmd/naming/simulator/simulator_v23_test.go b/cmd/naming/simulator/simulator_v23_test.go
index c297831..e1ac8ef 100644
--- a/cmd/naming/simulator/simulator_v23_test.go
+++ b/cmd/naming/simulator/simulator_v23_test.go
@@ -10,7 +10,7 @@
 	"regexp"
 	"testing"
 
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 func V23TestSimulator(t *v23tests.T) {
diff --git a/cmd/naming/simulator/v23_test.go b/cmd/naming/simulator/v23_test.go
index 94328a4..1453ba5 100644
--- a/cmd/naming/simulator/v23_test.go
+++ b/cmd/naming/simulator/v23_test.go
@@ -10,12 +10,12 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/cmd/principal/principal_v23_test.go b/cmd/principal/principal_v23_test.go
index fdc1718..74c1745 100644
--- a/cmd/principal/principal_v23_test.go
+++ b/cmd/principal/principal_v23_test.go
@@ -10,7 +10,7 @@
 	"strings"
 	"syscall"
 
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/cmd/principal/v23_test.go b/cmd/principal/v23_test.go
index ec323f3..b2a9bb3 100644
--- a/cmd/principal/v23_test.go
+++ b/cmd/principal/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/cmd/profile/impl_test.go b/cmd/profile/impl_test.go
index e07af3c..6178105 100644
--- a/cmd/profile/impl_test.go
+++ b/cmd/profile/impl_test.go
@@ -14,10 +14,10 @@
 	"v.io/v23/services/mgmt/build"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/mgmt/profile"
 	"v.io/x/ref/services/mgmt/repository"
+	"v.io/x/ref/test"
 )
 
 var (
@@ -110,7 +110,7 @@
 
 func TestProfileClient(t *testing.T) {
 	var shutdown v23.Shutdown
-	gctx, shutdown = testutil.InitForTest()
+	gctx, shutdown = test.InitForTest()
 	defer shutdown()
 
 	server, endpoint, err := startServer(t, gctx)
diff --git a/cmd/servicerunner/main.go b/cmd/servicerunner/main.go
index 4d33f26..d80c2ab 100644
--- a/cmd/servicerunner/main.go
+++ b/cmd/servicerunner/main.go
@@ -12,11 +12,11 @@
 	"v.io/v23"
 
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/modules/core"
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/testutil/expect"
 	"v.io/x/ref/profiles"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/modules/core"
 )
 
 func panicOnError(err error) {
diff --git a/cmd/servicerunner/servicerunner_test.go b/cmd/servicerunner/servicerunner_test.go
index c5614e9..fba11f1 100644
--- a/cmd/servicerunner/servicerunner_test.go
+++ b/cmd/servicerunner/servicerunner_test.go
@@ -12,7 +12,7 @@
 	"path"
 	"testing"
 
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test/testutil"
 )
 
 func TestServiceRunner(t *testing.T) {
diff --git a/cmd/vdl/arith_test.go b/cmd/vdl/arith_test.go
index b54cdf9..1ce37bd 100644
--- a/cmd/vdl/arith_test.go
+++ b/cmd/vdl/arith_test.go
@@ -18,8 +18,8 @@
 	"v.io/x/ref/lib/vdl/testdata/arith"
 	"v.io/x/ref/lib/vdl/testdata/base"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 var generatedError = errors.New("generated error")
@@ -104,7 +104,7 @@
 }
 
 func TestCalculator(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	server := newServer(ctx)
@@ -277,7 +277,7 @@
 }
 
 func TestArith(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	// TODO(bprosnitz) Split this test up -- it is quite long and hard to debug.
diff --git a/cmd/vrpc/vrpc_test.go b/cmd/vrpc/vrpc_test.go
index 0c98bc1..70e4f10 100644
--- a/cmd/vrpc/vrpc_test.go
+++ b/cmd/vrpc/vrpc_test.go
@@ -10,8 +10,8 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/cmd/vrpc/test_base"
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 type server struct{}
@@ -109,7 +109,7 @@
 
 func initTest(t *testing.T) (name string, shutdown v23.Shutdown) {
 	// The gctx initialized here is the global context defined in vrpc.go.
-	gctx, shutdown = testutil.InitForTest()
+	gctx, shutdown = test.InitForTest()
 
 	ipcServer, err := v23.NewServer(gctx)
 	if err != nil {
diff --git a/cmd/vrun/internal/v23_test.go b/cmd/vrun/internal/v23_test.go
index b3abb99..dd6a542 100644
--- a/cmd/vrun/internal/v23_test.go
+++ b/cmd/vrun/internal/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/cmd/vrun/internal/vrun_v23_test.go b/cmd/vrun/internal/vrun_v23_test.go
index 30efa19..ffe16b5 100644
--- a/cmd/vrun/internal/vrun_v23_test.go
+++ b/cmd/vrun/internal/vrun_v23_test.go
@@ -5,8 +5,8 @@
 import (
 	"os"
 
-	"v.io/x/ref/lib/testutil/v23tests"
 	_ "v.io/x/ref/profiles/static"
+	"v.io/x/ref/test/v23tests"
 )
 
 func V23TestAgentd(t *v23tests.T) {
diff --git a/examples/rps/rpsbot/impl_test.go b/examples/rps/rpsbot/impl_test.go
index cb97524..e7b3b49 100644
--- a/examples/rps/rpsbot/impl_test.go
+++ b/examples/rps/rpsbot/impl_test.go
@@ -17,10 +17,10 @@
 	"v.io/v23/context"
 	"v.io/v23/ipc"
 	"v.io/x/ref/examples/rps"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/modules/core"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/modules/core"
 )
 
 //go:generate v23 test generate
@@ -56,7 +56,7 @@
 // TestRockPaperScissorsImpl runs one rock-paper-scissors game and verifies
 // that all the counters are consistent.
 func TestRockPaperScissorsImpl(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(nil, nil)
diff --git a/examples/rps/rpsbot/v23_internal_test.go b/examples/rps/rpsbot/v23_internal_test.go
index 6ab5fba..f64b7f9 100644
--- a/examples/rps/rpsbot/v23_internal_test.go
+++ b/examples/rps/rpsbot/v23_internal_test.go
@@ -10,11 +10,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/examples/tunnel/tunneld/tunneld_v23_test.go b/examples/tunnel/tunneld/tunneld_v23_test.go
index be0361a..b5e6d49 100644
--- a/examples/tunnel/tunneld/tunneld_v23_test.go
+++ b/examples/tunnel/tunneld/tunneld_v23_test.go
@@ -9,7 +9,7 @@
 	"path/filepath"
 	"regexp"
 
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 func V23TestTunneld(t *v23tests.T) {
diff --git a/examples/tunnel/tunneld/v23_test.go b/examples/tunnel/tunneld/v23_test.go
index 3b31d68..c2a1b48 100644
--- a/examples/tunnel/tunneld/v23_test.go
+++ b/examples/tunnel/tunneld/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/lib/exec/exec_test.go b/lib/exec/exec_test.go
index 4fbdd48..e72367b 100644
--- a/lib/exec/exec_test.go
+++ b/lib/exec/exec_test.go
@@ -16,7 +16,7 @@
 	vexec "v.io/x/ref/lib/exec"
 	"v.io/x/ref/lib/exec/consts"
 	// Use mock timekeeper to avoid actually sleeping during the test.
-	"v.io/x/ref/lib/testutil/timekeeper"
+	"v.io/x/ref/test/timekeeper"
 )
 
 // We always expect there to be exactly three open file descriptors
diff --git a/lib/signals/signals_test.go b/lib/signals/signals_test.go
index b74bbc0..293f7c3 100644
--- a/lib/signals/signals_test.go
+++ b/lib/signals/signals_test.go
@@ -19,12 +19,12 @@
 	"v.io/v23/services/mgmt/appcycle"
 	"v.io/v23/vtrace"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
 	_ "v.io/x/ref/profiles"
 	vflag "v.io/x/ref/security/flag"
 	"v.io/x/ref/services/mgmt/device"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
 )
 
 //go:generate v23 test generate
@@ -43,7 +43,7 @@
 }
 
 func program(stdin io.Reader, stdout io.Writer, signals ...os.Signal) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	closeStopLoop := make(chan struct{})
 	go stopLoop(v23.GetAppCycle(ctx).Stop, stdin, closeStopLoop)
 	wait := ShutdownOnSignals(ctx, signals...)
@@ -69,7 +69,7 @@
 }
 
 func handleDefaultsIgnoreChan(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	closeStopLoop := make(chan struct{})
@@ -119,7 +119,7 @@
 // TestCleanShutdownSignal verifies that sending a signal to a child that
 // handles it by default causes the child to shut down cleanly.
 func TestCleanShutdownSignal(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -135,7 +135,7 @@
 // TestCleanShutdownStop verifies that sending a stop comamnd to a child that
 // handles stop commands by default causes the child to shut down cleanly.
 func TestCleanShutdownStop(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -152,7 +152,7 @@
 // that handles stop command as part of a custom set of signals handled, causes
 // the child to shut down cleanly.
 func TestCleanShutdownStopCustom(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleCustomWithStop")
@@ -176,7 +176,7 @@
 // TestStopNoHandler verifies that sending a stop command to a child that does
 // not handle stop commands causes the child to exit immediately.
 func TestStopNoHandler(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleCustom")
@@ -190,7 +190,7 @@
 // that handles these signals by default causes the child to exit immediately
 // upon receiving the second signal.
 func TestDoubleSignal(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -208,7 +208,7 @@
 // to a child that handles these by default causes the child to exit immediately
 // upon receiving the stop command.
 func TestSignalAndStop(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -225,7 +225,7 @@
 // that handles stop commands by default causes the child to exit immediately
 // upon receiving the second stop command.
 func TestDoubleStop(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -240,7 +240,7 @@
 // TestSendUnhandledSignal verifies that sending a signal that the child does
 // not handle causes the child to exit as per the signal being sent.
 func TestSendUnhandledSignal(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaults")
@@ -256,7 +256,7 @@
 // process to exit (ensures that there is no dependency in ShutdownOnSignals
 // on having a goroutine read from the returned channel).
 func TestDoubleSignalIgnoreChan(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleDefaultsIgnoreChan")
@@ -274,7 +274,7 @@
 // TestHandlerCustomSignal verifies that sending a non-default signal to a
 // server that listens for that signal causes the server to shut down cleanly.
 func TestHandlerCustomSignal(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, h, s := newShell(t, ctx, "handleCustom")
@@ -291,7 +291,7 @@
 // to a server that listens for that signal causes the server to shut down
 // cleanly, even when a STOP signal is also among the handled signals.
 func TestHandlerCustomSignalWithStop(t *testing.T) {
-	rootCtx, shutdown := testutil.InitForTest()
+	rootCtx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	for _, signal := range []syscall.Signal{syscall.SIGABRT, syscall.SIGHUP} {
@@ -352,7 +352,7 @@
 
 // TestCleanRemoteShutdown verifies that remote shutdown works correctly.
 func TestCleanRemoteShutdown(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
diff --git a/lib/signals/v23_internal_test.go b/lib/signals/v23_internal_test.go
index 3fbd22d..4d2767f 100644
--- a/lib/signals/v23_internal_test.go
+++ b/lib/signals/v23_internal_test.go
@@ -10,8 +10,8 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func init() {
 	modules.RegisterChild("handleDefaults", ``, handleDefaults)
@@ -21,7 +21,7 @@
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/profiles/fake/runtime.go b/profiles/fake/runtime.go
index 6a2e458..c947546 100644
--- a/profiles/fake/runtime.go
+++ b/profiles/fake/runtime.go
@@ -8,7 +8,7 @@
 	"v.io/v23/context"
 	"v.io/v23/security"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 type contextKey int
diff --git a/profiles/internal/ipc/benchmark/benchmark/main.go b/profiles/internal/ipc/benchmark/benchmark/main.go
index 71190f5..118005e 100644
--- a/profiles/internal/ipc/benchmark/benchmark/main.go
+++ b/profiles/internal/ipc/benchmark/benchmark/main.go
@@ -8,9 +8,9 @@
 	"testing"
 	"time"
 
-	tbm "v.io/x/ref/lib/testutil/benchmark"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/profiles/internal/ipc/benchmark/internal"
+	tbm "v.io/x/ref/test/benchmark"
 
 	"v.io/v23"
 	"v.io/x/lib/vlog"
diff --git a/profiles/internal/ipc/benchmark/benchmark_test.go b/profiles/internal/ipc/benchmark/benchmark_test.go
index f788349..ce11b2c 100644
--- a/profiles/internal/ipc/benchmark/benchmark_test.go
+++ b/profiles/internal/ipc/benchmark/benchmark_test.go
@@ -7,10 +7,10 @@
 	"v.io/v23"
 	"v.io/v23/context"
 
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/benchmark"
 	"v.io/x/ref/profiles/internal/ipc/benchmark/internal"
 	_ "v.io/x/ref/profiles/static"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/benchmark"
 )
 
 var (
@@ -105,7 +105,7 @@
 	// We do not use defer here since this program will exit at the end of
 	// this function through os.Exit().
 	var shutdown v23.Shutdown
-	ctx, shutdown = testutil.InitForTest()
+	ctx, shutdown = test.InitForTest()
 
 	var serverStop func()
 	serverAddr, serverStop = internal.StartServer(ctx, v23.GetListenSpec(ctx))
diff --git a/profiles/internal/ipc/benchmark/glob/glob_test.go b/profiles/internal/ipc/benchmark/glob/glob_test.go
index ce83d50..ed82ae4 100644
--- a/profiles/internal/ipc/benchmark/glob/glob_test.go
+++ b/profiles/internal/ipc/benchmark/glob/glob_test.go
@@ -10,8 +10,8 @@
 	"v.io/v23/naming"
 	"v.io/v23/security"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 func TestNothing(t *testing.T) {
@@ -155,7 +155,7 @@
 }
 
 func RunBenchmarkGlob(b *testing.B, obj interface{}) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	addr, stop, err := startServer(b, ctx, obj)
diff --git a/profiles/internal/ipc/benchmark/internal/client.go b/profiles/internal/ipc/benchmark/internal/client.go
index f8534b2..54fbfc6 100644
--- a/profiles/internal/ipc/benchmark/internal/client.go
+++ b/profiles/internal/ipc/benchmark/internal/client.go
@@ -9,8 +9,8 @@
 	"v.io/v23/context"
 	"v.io/x/lib/vlog"
 
-	tbm "v.io/x/ref/lib/testutil/benchmark"
 	"v.io/x/ref/profiles/internal/ipc/benchmark"
+	tbm "v.io/x/ref/test/benchmark"
 )
 
 // CallEcho calls 'Echo' method 'iterations' times with the given payload size.
diff --git a/profiles/internal/ipc/cancel_test.go b/profiles/internal/ipc/cancel_test.go
index 4154aaa..43c0ea5 100644
--- a/profiles/internal/ipc/cancel_test.go
+++ b/profiles/internal/ipc/cancel_test.go
@@ -3,10 +3,10 @@
 import (
 	"testing"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/profiles/internal/ipc/stream"
 	"v.io/x/ref/profiles/internal/ipc/stream/manager"
 	tnaming "v.io/x/ref/profiles/internal/testing/mocks/naming"
+	tsecurity "v.io/x/ref/test/security"
 
 	"v.io/v23/context"
 	"v.io/v23/ipc"
diff --git a/profiles/internal/ipc/debug_test.go b/profiles/internal/ipc/debug_test.go
index 502995d..d7aedb6 100644
--- a/profiles/internal/ipc/debug_test.go
+++ b/profiles/internal/ipc/debug_test.go
@@ -12,11 +12,11 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/stats"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/profiles/internal/ipc/stream/manager"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	tnaming "v.io/x/ref/profiles/internal/testing/mocks/naming"
 	"v.io/x/ref/services/mgmt/debug"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func TestDebugServer(t *testing.T) {
diff --git a/profiles/internal/ipc/default_authorizer_test.go b/profiles/internal/ipc/default_authorizer_test.go
index 7ea28f5..4a30698 100644
--- a/profiles/internal/ipc/default_authorizer_test.go
+++ b/profiles/internal/ipc/default_authorizer_test.go
@@ -4,7 +4,7 @@
 	"testing"
 
 	"v.io/v23/security"
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func TestDefaultAuthorizer(t *testing.T) {
diff --git a/profiles/internal/ipc/discharges_test.go b/profiles/internal/ipc/discharges_test.go
index 230b8bf..4250605 100644
--- a/profiles/internal/ipc/discharges_test.go
+++ b/profiles/internal/ipc/discharges_test.go
@@ -4,7 +4,7 @@
 	"testing"
 	"time"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	tsecurity "v.io/x/ref/test/security"
 
 	"v.io/v23/security"
 	"v.io/v23/vdl"
diff --git a/profiles/internal/ipc/full_test.go b/profiles/internal/ipc/full_test.go
index d6d9da7..f964e97 100644
--- a/profiles/internal/ipc/full_test.go
+++ b/profiles/internal/ipc/full_test.go
@@ -32,8 +32,6 @@
 	"v.io/x/lib/netstate"
 	"v.io/x/ref/lib/flags"
 	"v.io/x/ref/lib/stats"
-	tsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/tcp"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/ws"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/wsh"
@@ -44,6 +42,8 @@
 	inaming "v.io/x/ref/profiles/internal/naming"
 	tnaming "v.io/x/ref/profiles/internal/testing/mocks/naming"
 	ivtrace "v.io/x/ref/profiles/internal/vtrace"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/ipc/resolve_test.go b/profiles/internal/ipc/resolve_test.go
index 95a47db..ae33d34 100644
--- a/profiles/internal/ipc/resolve_test.go
+++ b/profiles/internal/ipc/resolve_test.go
@@ -12,16 +12,16 @@
 	"v.io/v23/naming"
 
 	"v.io/x/ref/lib/flags"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/modules/core"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
 	"v.io/x/ref/profiles/fake"
 	"v.io/x/ref/profiles/internal"
 	iipc "v.io/x/ref/profiles/internal/ipc"
 	"v.io/x/ref/profiles/internal/lib/appcycle"
 	inaming "v.io/x/ref/profiles/internal/naming"
 	grt "v.io/x/ref/profiles/internal/rt"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/modules/core"
 )
 
 var commonFlags *flags.Flags
@@ -74,7 +74,7 @@
 	defer sh.Cleanup(nil, nil)
 	root := startMT(t, sh)
 
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	ns := v23.GetNamespace(ctx)
diff --git a/profiles/internal/ipc/results_store_test.go b/profiles/internal/ipc/results_store_test.go
index 757f344..108f025 100644
--- a/profiles/internal/ipc/results_store_test.go
+++ b/profiles/internal/ipc/results_store_test.go
@@ -5,7 +5,7 @@
 	"sync"
 	"testing"
 
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test/testutil"
 )
 
 func randomKeys() []uint64 {
diff --git a/profiles/internal/ipc/server_authorizer_test.go b/profiles/internal/ipc/server_authorizer_test.go
index 7e48d4a..04269ce 100644
--- a/profiles/internal/ipc/server_authorizer_test.go
+++ b/profiles/internal/ipc/server_authorizer_test.go
@@ -3,7 +3,7 @@
 import (
 	"testing"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	tsecurity "v.io/x/ref/test/security"
 
 	"v.io/v23/options"
 	"v.io/v23/security"
diff --git a/profiles/internal/ipc/server_test.go b/profiles/internal/ipc/server_test.go
index b43c634..37cbc17 100644
--- a/profiles/internal/ipc/server_test.go
+++ b/profiles/internal/ipc/server_test.go
@@ -16,11 +16,11 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/lib/netstate"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	imanager "v.io/x/ref/profiles/internal/ipc/stream/manager"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	inaming "v.io/x/ref/profiles/internal/naming"
 	tnaming "v.io/x/ref/profiles/internal/testing/mocks/naming"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 type noMethodsType struct{ Field string }
diff --git a/profiles/internal/ipc/stream/benchmark/benchmark_test.go b/profiles/internal/ipc/stream/benchmark/benchmark_test.go
index 4b62a27..d7b5f79 100644
--- a/profiles/internal/ipc/stream/benchmark/benchmark_test.go
+++ b/profiles/internal/ipc/stream/benchmark/benchmark_test.go
@@ -4,7 +4,7 @@
 	"os"
 	"testing"
 
-	"v.io/x/ref/lib/testutil/benchmark"
+	"v.io/x/ref/test/benchmark"
 )
 
 // A single empty test to avoid:
diff --git a/profiles/internal/ipc/stream/benchmark/dial_vc.go b/profiles/internal/ipc/stream/benchmark/dial_vc.go
index ca94f11..1b42060 100644
--- a/profiles/internal/ipc/stream/benchmark/dial_vc.go
+++ b/profiles/internal/ipc/stream/benchmark/dial_vc.go
@@ -4,10 +4,10 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/testutil/benchmark"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/profiles/internal/ipc/stream/manager"
 	_ "v.io/x/ref/profiles/static"
+	"v.io/x/ref/test/benchmark"
+	tsecurity "v.io/x/ref/test/security"
 
 	"v.io/v23/naming"
 	"v.io/v23/options"
diff --git a/profiles/internal/ipc/stream/benchmark/dial_vif.go b/profiles/internal/ipc/stream/benchmark/dial_vif.go
index fd1d47e..7224c8e 100644
--- a/profiles/internal/ipc/stream/benchmark/dial_vif.go
+++ b/profiles/internal/ipc/stream/benchmark/dial_vif.go
@@ -5,9 +5,9 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/testutil/benchmark"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/profiles/internal/ipc/stream/vif"
+	"v.io/x/ref/test/benchmark"
+	tsecurity "v.io/x/ref/test/security"
 
 	"v.io/v23/naming"
 	"v.io/v23/options"
diff --git a/profiles/internal/ipc/stream/benchmark/throughput_flow.go b/profiles/internal/ipc/stream/benchmark/throughput_flow.go
index 82e4b9c..d102382 100644
--- a/profiles/internal/ipc/stream/benchmark/throughput_flow.go
+++ b/profiles/internal/ipc/stream/benchmark/throughput_flow.go
@@ -8,8 +8,8 @@
 
 	"v.io/v23/naming"
 	"v.io/v23/options"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/profiles/internal/ipc/stream"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 const (
diff --git a/profiles/internal/ipc/stream/manager/manager_test.go b/profiles/internal/ipc/stream/manager/manager_test.go
index 3d7a1a5..bf6e893 100644
--- a/profiles/internal/ipc/stream/manager/manager_test.go
+++ b/profiles/internal/ipc/stream/manager/manager_test.go
@@ -13,22 +13,23 @@
 	"testing"
 	"time"
 
+	"v.io/x/lib/vlog"
+
 	"v.io/v23/ipc"
 	"v.io/v23/naming"
 	"v.io/v23/options"
 	"v.io/v23/security"
-	"v.io/x/lib/vlog"
-	"v.io/x/ref/profiles/internal/ipc/stream"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/tcp"
 	_ "v.io/x/ref/profiles/internal/ipc/protocols/ws"
+	"v.io/x/ref/profiles/internal/ipc/stream"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	"v.io/x/ref/profiles/internal/ipc/version"
 	inaming "v.io/x/ref/profiles/internal/naming"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func init() {
@@ -38,7 +39,7 @@
 // We write our own TestMain here instead of relying on v23 test generate because
 // we need to set runtime.GOMAXPROCS.
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	// testutil.Init sets GOMAXPROCS to NumCPU.  We want to force
 	// GOMAXPROCS to remain at 1, in order to trigger a particular race
 	// condition that occurs when closing the server; also, using 1 cpu
diff --git a/profiles/internal/ipc/stream/proxy/proxy_test.go b/profiles/internal/ipc/stream/proxy/proxy_test.go
index cc6d906..26123d6 100644
--- a/profiles/internal/ipc/stream/proxy/proxy_test.go
+++ b/profiles/internal/ipc/stream/proxy/proxy_test.go
@@ -11,10 +11,10 @@
 	"v.io/v23/naming"
 	"v.io/x/ref/profiles/internal/ipc/stream"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/profiles/internal/ipc/stream/manager"
 	"v.io/x/ref/profiles/internal/ipc/stream/proxy"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/ipc/stream/proxy/v23_internal_test.go b/profiles/internal/ipc/stream/proxy/v23_internal_test.go
index cea70bf..84bea54 100644
--- a/profiles/internal/ipc/stream/proxy/v23_internal_test.go
+++ b/profiles/internal/ipc/stream/proxy/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/ipc/stream/vc/v23_internal_test.go b/profiles/internal/ipc/stream/vc/v23_internal_test.go
index bfe8e63..945d8c4 100644
--- a/profiles/internal/ipc/stream/vc/v23_internal_test.go
+++ b/profiles/internal/ipc/stream/vc/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/ipc/stream/vc/vc_test.go b/profiles/internal/ipc/stream/vc/vc_test.go
index 9310a5c..7d634ae 100644
--- a/profiles/internal/ipc/stream/vc/vc_test.go
+++ b/profiles/internal/ipc/stream/vc/vc_test.go
@@ -22,14 +22,14 @@
 
 	"v.io/x/lib/vlog"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/profiles/internal/ipc/stream"
 	"v.io/x/ref/profiles/internal/ipc/stream/id"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	"v.io/x/ref/profiles/internal/lib/bqueue"
 	"v.io/x/ref/profiles/internal/lib/bqueue/drrqueue"
 	"v.io/x/ref/profiles/internal/lib/iobuf"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 )
 
 var (
diff --git a/profiles/internal/ipc/stream/vif/set_test.go b/profiles/internal/ipc/stream/vif/set_test.go
index e00a51b..ca53318 100644
--- a/profiles/internal/ipc/stream/vif/set_test.go
+++ b/profiles/internal/ipc/stream/vif/set_test.go
@@ -12,9 +12,9 @@
 	"v.io/v23/ipc"
 	"v.io/v23/naming"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/profiles/internal/ipc/stream/vif"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 var supportsIPv6 bool
diff --git a/profiles/internal/ipc/stream/vif/v23_internal_test.go b/profiles/internal/ipc/stream/vif/v23_internal_test.go
index 380f691..161553c 100644
--- a/profiles/internal/ipc/stream/vif/v23_internal_test.go
+++ b/profiles/internal/ipc/stream/vif/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/ipc/stream/vif/vif_test.go b/profiles/internal/ipc/stream/vif/vif_test.go
index 38ad2bb..cf99618 100644
--- a/profiles/internal/ipc/stream/vif/vif_test.go
+++ b/profiles/internal/ipc/stream/vif/vif_test.go
@@ -19,11 +19,11 @@
 	"v.io/v23/ipc/version"
 	"v.io/v23/naming"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	"v.io/x/ref/profiles/internal/ipc/stream/vif"
 	iversion "v.io/x/ref/profiles/internal/ipc/version"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 
 	"v.io/x/ref/profiles/internal/ipc/stream"
 )
diff --git a/profiles/internal/ipc/test/client_test.go b/profiles/internal/ipc/test/client_test.go
index a5a2156..30fd356 100644
--- a/profiles/internal/ipc/test/client_test.go
+++ b/profiles/internal/ipc/test/client_test.go
@@ -10,30 +10,29 @@
 	"testing"
 	"time"
 
+	"v.io/x/lib/vlog"
+
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/ipc"
 	"v.io/v23/naming"
 	"v.io/v23/options"
 	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/modules/core"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	inaming "v.io/x/ref/profiles/internal/naming"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/modules/core"
+	tsecurity "v.io/x/ref/test/security"
 )
 
-func init() {
-	modules.RegisterChild("ping", "<name>", childPing)
-}
+//go:generate v23 test generate .
 
 func newCtx() (*context.T, v23.Shutdown) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 	return ctx, shutdown
 }
@@ -165,7 +164,7 @@
 }
 
 func childPing(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
@@ -252,7 +251,7 @@
 }
 
 func TestAccessDenied(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	name, fn := initServer(t, ctx)
@@ -352,7 +351,7 @@
 	name, fn := initServer(t, ctx)
 	defer fn()
 
-	srv, err := sh.Start("ping", nil, name)
+	srv, err := sh.Start("childPing", nil, name)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -460,7 +459,8 @@
 // connection to the server if the server dies and comes back (on the same
 // endpoint).
 func TestReconnect(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	t.Skip()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, v23.GetPrincipal(ctx))
diff --git a/profiles/internal/ipc/test/glob_test.go b/profiles/internal/ipc/test/glob_test.go
index 760fbb1..239ee70 100644
--- a/profiles/internal/ipc/test/glob_test.go
+++ b/profiles/internal/ipc/test/glob_test.go
@@ -17,9 +17,9 @@
 	"v.io/v23/verror"
 
 	"v.io/x/ref/lib/glob"
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 )
 
 func startGlobServer(ctx *context.T, tree *node) (string, func(), error) {
diff --git a/profiles/internal/ipc/test/proxy_test.go b/profiles/internal/ipc/test/proxy_test.go
index 95310b0..0744417 100644
--- a/profiles/internal/ipc/test/proxy_test.go
+++ b/profiles/internal/ipc/test/proxy_test.go
@@ -21,9 +21,6 @@
 	"v.io/v23/vtrace"
 
 	"v.io/x/ref/lib/flags"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil/expect"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	iipc "v.io/x/ref/profiles/internal/ipc"
 	imanager "v.io/x/ref/profiles/internal/ipc/stream/manager"
@@ -33,6 +30,9 @@
 	inaming "v.io/x/ref/profiles/internal/naming"
 	tnaming "v.io/x/ref/profiles/internal/testing/mocks/naming"
 	ivtrace "v.io/x/ref/profiles/internal/vtrace"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func testContext() (*context.T, func()) {
diff --git a/profiles/internal/ipc/test/signature_test.go b/profiles/internal/ipc/test/signature_test.go
index 293f2f9..781a307 100644
--- a/profiles/internal/ipc/test/signature_test.go
+++ b/profiles/internal/ipc/test/signature_test.go
@@ -13,8 +13,8 @@
 	"v.io/v23/vdl"
 	"v.io/v23/vdlroot/signature"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 func startSigServer(ctx *context.T, sig sigImpl) (string, func(), error) {
@@ -56,7 +56,7 @@
 }
 
 func TestMethodSignature(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	ep, stop, err := startSigServer(ctx, sigImpl{})
 	if err != nil {
@@ -102,7 +102,7 @@
 }
 
 func TestSignature(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	ep, stop, err := startSigServer(ctx, sigImpl{})
 	if err != nil {
diff --git a/profiles/internal/ipc/test/v23_test.go b/profiles/internal/ipc/test/v23_internal_test.go
similarity index 88%
rename from profiles/internal/ipc/test/v23_test.go
rename to profiles/internal/ipc/test/v23_internal_test.go
index 3c00214..082fdf0 100644
--- a/profiles/internal/ipc/test/v23_test.go
+++ b/profiles/internal/ipc/test/v23_internal_test.go
@@ -10,8 +10,8 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func init() {
 	modules.RegisterChild("childPing", ``, childPing)
@@ -19,7 +19,7 @@
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/profiles/internal/ipc/v23_internal_test.go b/profiles/internal/ipc/v23_internal_test.go
index 20b059a..9597c2e 100644
--- a/profiles/internal/ipc/v23_internal_test.go
+++ b/profiles/internal/ipc/v23_internal_test.go
@@ -10,11 +10,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/profiles/internal/lib/deque/deque_test.go b/profiles/internal/lib/deque/deque_test.go
index 4906c2e..d1fbea2 100644
--- a/profiles/internal/lib/deque/deque_test.go
+++ b/profiles/internal/lib/deque/deque_test.go
@@ -3,7 +3,7 @@
 import (
 	"testing"
 
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/lib/deque/v23_internal_test.go b/profiles/internal/lib/deque/v23_internal_test.go
index 4381586..5091465 100644
--- a/profiles/internal/lib/deque/v23_internal_test.go
+++ b/profiles/internal/lib/deque/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/lib/pcqueue/v23_internal_test.go b/profiles/internal/lib/pcqueue/v23_internal_test.go
index 15b84d8..6475bd5 100644
--- a/profiles/internal/lib/pcqueue/v23_internal_test.go
+++ b/profiles/internal/lib/pcqueue/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/lib/publisher/v23_internal_test.go b/profiles/internal/lib/publisher/v23_internal_test.go
index 9c60f4c..399d8d5 100644
--- a/profiles/internal/lib/publisher/v23_internal_test.go
+++ b/profiles/internal/lib/publisher/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/lib/sync/v23_internal_test.go b/profiles/internal/lib/sync/v23_internal_test.go
index 1ad406c..008ca9f 100644
--- a/profiles/internal/lib/sync/v23_internal_test.go
+++ b/profiles/internal/lib/sync/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/lib/sync/wait_group_test.go b/profiles/internal/lib/sync/wait_group_test.go
index 8be3907..5b8bcbe 100644
--- a/profiles/internal/lib/sync/wait_group_test.go
+++ b/profiles/internal/lib/sync/wait_group_test.go
@@ -3,7 +3,7 @@
 import (
 	"testing"
 
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/lib/upcqueue/v23_internal_test.go b/profiles/internal/lib/upcqueue/v23_internal_test.go
index fe6dbaa..af1b3c8 100644
--- a/profiles/internal/lib/upcqueue/v23_internal_test.go
+++ b/profiles/internal/lib/upcqueue/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/lib/websocket/v23_internal_test.go b/profiles/internal/lib/websocket/v23_internal_test.go
index f942dfa..2051301 100644
--- a/profiles/internal/lib/websocket/v23_internal_test.go
+++ b/profiles/internal/lib/websocket/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/naming/namespace/acl_test.go b/profiles/internal/naming/namespace/acl_test.go
index 57361ef..7e7b0a7 100644
--- a/profiles/internal/naming/namespace/acl_test.go
+++ b/profiles/internal/naming/namespace/acl_test.go
@@ -12,18 +12,18 @@
 	"v.io/v23/security"
 	"v.io/v23/services/security/access"
 
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	service "v.io/x/ref/services/mounttable/lib"
+	"v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func init() {
-	testutil.Init()
+	test.Init()
 }
 
 func initTest() (rootCtx *context.T, aliceCtx *context.T, bobCtx *context.T, shutdown v23.Shutdown) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	var err error
 	if rootCtx, err = v23.SetPrincipal(ctx, tsecurity.NewPrincipal("root")); err != nil {
 		panic("failed to set root principal")
diff --git a/profiles/internal/naming/namespace/all_test.go b/profiles/internal/naming/namespace/all_test.go
index 7ea04ca..57fd5c7 100644
--- a/profiles/internal/naming/namespace/all_test.go
+++ b/profiles/internal/naming/namespace/all_test.go
@@ -18,13 +18,13 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	test "v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/profiles/internal/naming/namespace"
 	vsecurity "v.io/x/ref/security"
 	service "v.io/x/ref/services/mounttable/lib"
+	test "v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/naming/namespace/v23_internal_test.go b/profiles/internal/naming/namespace/v23_internal_test.go
index 314919a..15b3504 100644
--- a/profiles/internal/naming/namespace/v23_internal_test.go
+++ b/profiles/internal/naming/namespace/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/rt/ipc_test.go b/profiles/internal/rt/ipc_test.go
index e6a9e93..178bcb1 100644
--- a/profiles/internal/rt/ipc_test.go
+++ b/profiles/internal/rt/ipc_test.go
@@ -16,10 +16,10 @@
 	"v.io/v23/security"
 
 	"v.io/v23/verror"
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
+	"v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 //go:generate v23 test generate
@@ -96,7 +96,7 @@
 }
 
 func TestClientServerBlessings(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	var (
@@ -188,7 +188,7 @@
 }
 
 func TestServerEndpointBlessingNames(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	ctx, _ = v23.SetPrincipal(ctx, tsecurity.NewPrincipal("default"))
 
@@ -281,7 +281,7 @@
 }
 
 func TestServerDischarges(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	var (
diff --git a/profiles/internal/rt/mgmt_test.go b/profiles/internal/rt/mgmt_test.go
index fe6a77f..28e48d5 100644
--- a/profiles/internal/rt/mgmt_test.go
+++ b/profiles/internal/rt/mgmt_test.go
@@ -16,12 +16,12 @@
 	"v.io/v23/naming"
 	"v.io/v23/services/mgmt/appcycle"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
 	_ "v.io/x/ref/profiles"
 	vflag "v.io/x/ref/security/flag"
 	"v.io/x/ref/services/mgmt/device"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
 )
 
 //go:generate v23 test generate
@@ -35,7 +35,7 @@
 // TestBasic verifies that the basic plumbing works: LocalStop calls result in
 // stop messages being sent on the channel passed to WaitForStop.
 func TestBasic(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	m := v23.GetAppCycle(ctx)
@@ -57,7 +57,7 @@
 // TestMultipleWaiters verifies that the plumbing works with more than one
 // registered wait channel.
 func TestMultipleWaiters(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	m := v23.GetAppCycle(ctx)
@@ -80,7 +80,7 @@
 // channel is not being drained: once the channel's buffer fills up, future
 // Stops become no-ops.
 func TestMultipleStops(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	m := v23.GetAppCycle(ctx)
@@ -100,7 +100,7 @@
 }
 
 func noWaiters(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	m := v23.GetAppCycle(ctx)
@@ -131,7 +131,7 @@
 }
 
 func forceStop(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	m := v23.GetAppCycle(ctx)
@@ -181,7 +181,7 @@
 // TestProgress verifies that the ticker update/track logic works for a single
 // tracker.
 func TestProgress(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 
 	m := v23.GetAppCycle(ctx)
 	m.AdvanceGoal(50)
@@ -213,7 +213,7 @@
 // works for more than one tracker.  It also ensures that the runtime doesn't
 // block when the tracker channels are full.
 func TestProgressMultipleTrackers(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 
 	m := v23.GetAppCycle(ctx)
 	// ch1 is 1-buffered, ch2 is 2-buffered.
@@ -248,7 +248,7 @@
 }
 
 func app(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	m := v23.GetAppCycle(ctx)
@@ -293,7 +293,7 @@
 }
 
 func setupRemoteAppCycleMgr(t *testing.T) (*context.T, modules.Handle, appcycle.AppCycleClientMethods, func()) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 
 	configServer, configServiceName, ch := createConfigServer(t, ctx)
 	sh, err := modules.NewShell(ctx, v23.GetPrincipal(ctx))
diff --git a/profiles/internal/rt/rt_test.go b/profiles/internal/rt/rt_test.go
index 39a5f2f..7667bee 100644
--- a/profiles/internal/rt/rt_test.go
+++ b/profiles/internal/rt/rt_test.go
@@ -9,16 +9,17 @@
 	"testing"
 	"time"
 
-	"v.io/v23"
-	"v.io/v23/security"
 	"v.io/x/lib/vlog"
 
+	"v.io/v23"
+	"v.io/v23/security"
+
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/modules"
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
-	"v.io/x/ref/lib/testutil/testutil"
 	vsecurity "v.io/x/ref/security"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/rt/runtime_test.go b/profiles/internal/rt/runtime_test.go
index 79569c2..ee7beb9 100644
--- a/profiles/internal/rt/runtime_test.go
+++ b/profiles/internal/rt/runtime_test.go
@@ -8,9 +8,9 @@
 	"v.io/v23/naming"
 
 	"v.io/x/ref/lib/flags"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/profiles/internal/rt"
 	"v.io/x/ref/security"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 // InitForTest creates a context for use in a test.
diff --git a/profiles/internal/rt/shutdown_servers_test.go b/profiles/internal/rt/shutdown_servers_test.go
index 4970251..3723552 100644
--- a/profiles/internal/rt/shutdown_servers_test.go
+++ b/profiles/internal/rt/shutdown_servers_test.go
@@ -9,15 +9,16 @@
 	"sync"
 	"syscall"
 
+	"v.io/x/lib/vlog"
+
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/ipc"
-	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/modules"
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/modules"
 )
 
 func init() {
@@ -72,7 +73,7 @@
 // For a more typical server, see simpleServerProgram.
 func complexServerProgram(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	// Initialize the runtime.  This is boilerplate.
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	// shutdown is optional, but it's a good idea to clean up, especially
 	// since it takes care of flushing the logs before exiting.
 	defer shutdown()
@@ -214,7 +215,7 @@
 // complexServerProgram.
 func simpleServerProgram(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
 	// Initialize the runtime.  This is boilerplate.
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	// Calling shutdown is optional, but it's a good idea to clean up, especially
 	// since it takes care of flushing the logs before exiting.
 	//
diff --git a/profiles/internal/rt/shutdown_test.go b/profiles/internal/rt/shutdown_test.go
index 0bf368b..6fec783 100644
--- a/profiles/internal/rt/shutdown_test.go
+++ b/profiles/internal/rt/shutdown_test.go
@@ -10,9 +10,9 @@
 
 	"v.io/v23"
 
-	"v.io/x/ref/lib/modules"
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/testutil/expect"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/rt/signal_test.go b/profiles/internal/rt/signal_test.go
index 5ebceba..0aa0301 100644
--- a/profiles/internal/rt/signal_test.go
+++ b/profiles/internal/rt/signal_test.go
@@ -9,10 +9,10 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
 )
 
 func init() {
@@ -30,7 +30,7 @@
 }
 
 func withRuntime(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	_, shutdown := testutil.InitForTest()
+	_, shutdown := test.InitForTest()
 	defer shutdown()
 
 	simpleEchoProgram(stdin, stdout)
diff --git a/profiles/internal/rt/v23_test.go b/profiles/internal/rt/v23_test.go
index f1d3bd1..774f3c3 100644
--- a/profiles/internal/rt/v23_test.go
+++ b/profiles/internal/rt/v23_test.go
@@ -10,8 +10,8 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func init() {
 	modules.RegisterChild("noWaiters", ``, noWaiters)
@@ -34,7 +34,7 @@
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/profiles/internal/testing/concurrency/clock_test.go b/profiles/internal/testing/concurrency/clock_test.go
index 064f2ef..9728d07 100644
--- a/profiles/internal/testing/concurrency/clock_test.go
+++ b/profiles/internal/testing/concurrency/clock_test.go
@@ -3,7 +3,7 @@
 import (
 	"testing"
 
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate
diff --git a/profiles/internal/testing/concurrency/v23_internal_test.go b/profiles/internal/testing/concurrency/v23_internal_test.go
index 55d3f56..e2d51cf 100644
--- a/profiles/internal/testing/concurrency/v23_internal_test.go
+++ b/profiles/internal/testing/concurrency/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/profiles/internal/vtrace/vtrace_test.go b/profiles/internal/vtrace/vtrace_test.go
index abb7dee..fe53f3a 100644
--- a/profiles/internal/vtrace/vtrace_test.go
+++ b/profiles/internal/vtrace/vtrace_test.go
@@ -14,17 +14,17 @@
 	"v.io/v23/vtrace"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	iipc "v.io/x/ref/profiles/internal/ipc"
 	"v.io/x/ref/profiles/internal/ipc/stream"
 	"v.io/x/ref/profiles/internal/ipc/stream/manager"
 	tnaming "v.io/x/ref/profiles/internal/testing/mocks/naming"
+	"v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func TestNewFromContext(t *testing.T) {
-	c0, shutdown := testutil.InitForTest()
+	c0, shutdown := test.InitForTest()
 	defer shutdown()
 	c1, s1 := vtrace.SetNewSpan(c0, "s1")
 	c2, s2 := vtrace.SetNewSpan(c1, "s2")
@@ -226,7 +226,7 @@
 // TestCancellationPropagation tests that cancellation propogates along an
 // RPC call chain without user intervention.
 func TestTraceAcrossRPCs(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	ctx, span := vtrace.SetNewSpan(ctx, "")
 	vtrace.ForceCollect(ctx)
@@ -250,7 +250,7 @@
 // TestCancellationPropagationLateForce tests that cancellation propogates along an
 // RPC call chain when tracing is initiated by someone deep in the call chain.
 func TestTraceAcrossRPCsLateForce(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	ctx, span := vtrace.SetNewSpan(ctx, "")
 	span.Annotate("c0-begin")
diff --git a/security/agent/agent_test.go b/security/agent/agent_test.go
index b47c080..11f5e14 100644
--- a/security/agent/agent_test.go
+++ b/security/agent/agent_test.go
@@ -10,13 +10,13 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/security/agent"
 	"v.io/x/ref/security/agent/server"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	tsecurity "v.io/x/ref/test/security"
 
 	"v.io/v23"
 	"v.io/v23/context"
@@ -26,7 +26,7 @@
 //go:generate v23 test generate
 
 func getPrincipalAndHang(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	p := v23.GetPrincipal(ctx)
@@ -80,7 +80,7 @@
 }
 
 func TestAgent(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	var (
@@ -139,7 +139,7 @@
 }
 
 func TestAgentShutdown(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 
 	// This starts an agent
 	sh, err := modules.NewShell(ctx, nil)
@@ -218,73 +218,73 @@
 }
 
 func BenchmarkSignNoAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runSignBenchmark(b, v23.GetPrincipal(ctx))
 }
 
 func BenchmarkSignCachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runSignBenchmark(b, setupAgent(ctx, true))
 }
 
 func BenchmarkSignUncachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runSignBenchmark(b, setupAgent(ctx, false))
 }
 
 func BenchmarkDefaultNoAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runDefaultBenchmark(b, v23.GetPrincipal(ctx))
 }
 
 func BenchmarkDefaultCachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runDefaultBenchmark(b, setupAgent(ctx, true))
 }
 
 func BenchmarkDefaultUncachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runDefaultBenchmark(b, setupAgent(ctx, false))
 }
 
 func BenchmarkRecognizedNegativeNoAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runRecognizedNegativeBenchmark(b, v23.GetPrincipal(ctx))
 }
 
 func BenchmarkRecognizedNegativeCachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runRecognizedNegativeBenchmark(b, setupAgent(ctx, true))
 }
 
 func BenchmarkRecognizedNegativeUncachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runRecognizedNegativeBenchmark(b, setupAgent(ctx, false))
 }
 
 func BenchmarkRecognizedNoAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runRecognizedBenchmark(b, v23.GetPrincipal(ctx))
 }
 
 func BenchmarkRecognizedCachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runRecognizedBenchmark(b, setupAgent(ctx, true))
 }
 
 func BenchmarkRecognizedUncachedAgent(b *testing.B) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	runRecognizedBenchmark(b, setupAgent(ctx, false))
 }
diff --git a/security/agent/agent_v23_test.go b/security/agent/agent_v23_test.go
index 73a6ef0..e068999 100644
--- a/security/agent/agent_v23_test.go
+++ b/security/agent/agent_v23_test.go
@@ -9,7 +9,7 @@
 	"runtime"
 	"strings"
 
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/security/agent/cache/cache_test.go b/security/agent/cache/cache_test.go
index 78ad231..4e1a383 100644
--- a/security/agent/cache/cache_test.go
+++ b/security/agent/cache/cache_test.go
@@ -6,8 +6,8 @@
 	"sync"
 	"testing"
 	"v.io/v23/security"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	isecurity "v.io/x/ref/security"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func createRoots() (security.PublicKey, security.BlessingRoots, *cachedRoots) {
diff --git a/security/agent/keymgr/keymgr_test.go b/security/agent/keymgr/keymgr_test.go
index c055e2c..ec1dcd9 100644
--- a/security/agent/keymgr/keymgr_test.go
+++ b/security/agent/keymgr/keymgr_test.go
@@ -8,10 +8,10 @@
 	"syscall"
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/security/agent"
 	"v.io/x/ref/security/agent/server"
+	"v.io/x/ref/test"
 
 	"v.io/v23"
 	"v.io/v23/context"
@@ -40,7 +40,7 @@
 }
 
 func TestNoDeviceManager(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	agent, cleanup, err := createAgent(ctx, "")
@@ -72,7 +72,7 @@
 }
 
 func TestSigning(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	path, err := ioutil.TempDir("", "agent")
@@ -139,7 +139,7 @@
 }
 
 func TestInMemorySigning(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	path, err := ioutil.TempDir("", "agent")
diff --git a/security/agent/pingpong/main.go b/security/agent/pingpong/main.go
index 66b07b4..bc0b2e1 100644
--- a/security/agent/pingpong/main.go
+++ b/security/agent/pingpong/main.go
@@ -12,8 +12,8 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 var runServer = flag.Bool("server", false, "Whether to run in server mode")
@@ -64,7 +64,7 @@
 func (allowEveryone) Authorize(security.Call) error { return nil }
 
 func main() {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	if *runServer {
diff --git a/security/agent/test_principal/main.go b/security/agent/test_principal/main.go
index 1f53d99..657c100 100644
--- a/security/agent/test_principal/main.go
+++ b/security/agent/test_principal/main.go
@@ -11,8 +11,8 @@
 
 	"v.io/v23"
 	"v.io/v23/security"
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 func newKey() security.PublicKey {
@@ -40,7 +40,7 @@
 		errors = append(errors, fmt.Sprintf("%v:%d: %v", file, line, fmt.Sprintf(format, args...)))
 	}
 
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	p := v23.GetPrincipal(ctx)
diff --git a/security/agent/v23_test.go b/security/agent/v23_test.go
index 68dcf3c..61f3ce8 100644
--- a/security/agent/v23_test.go
+++ b/security/agent/v23_test.go
@@ -10,16 +10,16 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
+import "v.io/x/ref/test/v23tests"
 
 func init() {
 	modules.RegisterChild("getPrincipalAndHang", ``, getPrincipalAndHang)
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/security/flag/flag_test.go b/security/flag/flag_test.go
index 8812c8e..107532e 100644
--- a/security/flag/flag_test.go
+++ b/security/flag/flag_test.go
@@ -12,8 +12,8 @@
 	"v.io/v23/security"
 	"v.io/v23/services/security/access"
 
-	"v.io/x/ref/lib/modules"
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/x/ref/test/modules"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 //go:generate v23 test generate
diff --git a/security/flag/v23_internal_test.go b/security/flag/v23_internal_test.go
index 1f17192..ee2061a 100644
--- a/security/flag/v23_internal_test.go
+++ b/security/flag/v23_internal_test.go
@@ -10,15 +10,15 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func init() {
 	modules.RegisterChild("tamFromFlag", ``, tamFromFlag)
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/security/serialization/serialization_test.go b/security/serialization/serialization_test.go
index 9ab7e9e..4a4b863 100644
--- a/security/serialization/serialization_test.go
+++ b/security/serialization/serialization_test.go
@@ -14,9 +14,9 @@
 	"strings"
 	"testing"
 
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/security/serialization"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 
 	"v.io/v23/security"
 )
diff --git a/services/GO.PACKAGE b/services/GO.PACKAGE
index 072df54..7ff1b13 100644
--- a/services/GO.PACKAGE
+++ b/services/GO.PACKAGE
@@ -2,6 +2,7 @@
 	"dependencies": {
 		"incoming": [
 			{"allow": "v.io/x/ref/services/..."},
+			{"allow": "v.io/x/ref/test/modules/core", "comment":"temporarily allowing dependency from lib"},
 			{"allow": "v.io/x/ref/lib/...", "comment":"temporarily allowing dependency from lib"},
 			{"allow": "v.io/x/ref/profiles/...", "comment":"temporarily allowing dependency from profiles"},
 			{"allow": "v.io/x/ref/cmd/...", "comment":"temporarily allowing dependency from veyron/tools"},
diff --git a/services/identity/handlers/handlers_test.go b/services/identity/handlers/handlers_test.go
index 930c5e5..d66b245 100644
--- a/services/identity/handlers/handlers_test.go
+++ b/services/identity/handlers/handlers_test.go
@@ -11,7 +11,7 @@
 
 	"v.io/v23/security"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func TestBlessingRoot(t *testing.T) {
diff --git a/services/identity/identityd/identityd_v23_test.go b/services/identity/identityd/identityd_v23_test.go
index 9c2a9d2..5f3e11e 100644
--- a/services/identity/identityd/identityd_v23_test.go
+++ b/services/identity/identityd/identityd_v23_test.go
@@ -9,7 +9,7 @@
 	"strings"
 	"time"
 
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate .
diff --git a/services/identity/identityd/v23_test.go b/services/identity/identityd/v23_test.go
index f249854..13c2816 100644
--- a/services/identity/identityd/v23_test.go
+++ b/services/identity/identityd/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/services/identity/revocation/revocation_test.go b/services/identity/revocation/revocation_test.go
index 04daac0..d924c8c 100644
--- a/services/identity/revocation/revocation_test.go
+++ b/services/identity/revocation/revocation_test.go
@@ -3,10 +3,10 @@
 import (
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
 	services "v.io/x/ref/services/security"
 	"v.io/x/ref/services/security/discharger"
+	"v.io/x/ref/test"
 
 	"v.io/v23"
 	"v.io/v23/context"
@@ -36,7 +36,7 @@
 }
 
 func TestDischargeRevokeDischargeRevokeDischarge(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	dcKey, dc, revoker, closeFunc := revokerSetup(t, ctx)
diff --git a/services/mgmt/application/applicationd/applicationd_v23_test.go b/services/mgmt/application/applicationd/applicationd_v23_test.go
index a83f38f..b17e5ca 100644
--- a/services/mgmt/application/applicationd/applicationd_v23_test.go
+++ b/services/mgmt/application/applicationd/applicationd_v23_test.go
@@ -7,9 +7,9 @@
 
 	"v.io/v23/naming"
 	"v.io/v23/security"
-	libsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/v23tests"
 	vsecurity "v.io/x/ref/security"
+	libsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/services/mgmt/application/applicationd/v23_test.go b/services/mgmt/application/applicationd/v23_test.go
index 34bbce6..860058d 100644
--- a/services/mgmt/application/applicationd/v23_test.go
+++ b/services/mgmt/application/applicationd/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/services/mgmt/application/impl/acl_test.go b/services/mgmt/application/impl/acl_test.go
index 21aecf1..05e7022 100644
--- a/services/mgmt/application/impl/acl_test.go
+++ b/services/mgmt/application/impl/acl_test.go
@@ -17,11 +17,11 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/services/mgmt/application/impl"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
 	"v.io/x/ref/services/mgmt/repository"
+	"v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 //go:generate v23 test generate
@@ -37,7 +37,7 @@
 	publishName := args[0]
 	storedir := args[1]
 
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
@@ -65,7 +65,7 @@
 }
 
 func TestApplicationUpdateAccessList(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
@@ -195,7 +195,7 @@
 }
 
 func TestPerAppAccessList(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 	// By default, all principals in this test will have blessings
diff --git a/services/mgmt/application/impl/impl_test.go b/services/mgmt/application/impl/impl_test.go
index 66d980d..98701f7 100644
--- a/services/mgmt/application/impl/impl_test.go
+++ b/services/mgmt/application/impl/impl_test.go
@@ -13,9 +13,9 @@
 	"v.io/v23/services/mgmt/application"
 	"v.io/v23/verror"
 
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/static"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 	//vsecurity "v.io/x/ref/security"
 	"v.io/x/ref/services/mgmt/application/impl"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
diff --git a/services/mgmt/application/impl/v23_test.go b/services/mgmt/application/impl/v23_test.go
index 125eb9e..f47a50b 100644
--- a/services/mgmt/application/impl/v23_test.go
+++ b/services/mgmt/application/impl/v23_test.go
@@ -10,15 +10,15 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func init() {
 	modules.RegisterChild("appRepository", ``, appRepository)
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/services/mgmt/binary/binaryd/binaryd_v23_test.go b/services/mgmt/binary/binaryd/binaryd_v23_test.go
index ae16308..079f90f 100644
--- a/services/mgmt/binary/binaryd/binaryd_v23_test.go
+++ b/services/mgmt/binary/binaryd/binaryd_v23_test.go
@@ -10,9 +10,9 @@
 	"strings"
 
 	"v.io/v23/naming"
-	"v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/services/mgmt/binary/binaryd/v23_test.go b/services/mgmt/binary/binaryd/v23_test.go
index c621fe1..b7aae18 100644
--- a/services/mgmt/binary/binaryd/v23_test.go
+++ b/services/mgmt/binary/binaryd/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/services/mgmt/binary/impl/acl_test.go b/services/mgmt/binary/impl/acl_test.go
index f7cd371..e498592 100644
--- a/services/mgmt/binary/impl/acl_test.go
+++ b/services/mgmt/binary/impl/acl_test.go
@@ -17,10 +17,10 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	"v.io/x/ref/services/mgmt/binary/impl"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 //go:generate v23 test generate
@@ -36,7 +36,7 @@
 	publishName := args[0]
 	storedir := args[1]
 
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 
 	defer fmt.Fprintf(stdout, "%v terminating\n", publishName)
 	defer vlog.VI(1).Infof("%v terminating", publishName)
@@ -70,7 +70,7 @@
 }
 
 func TestBinaryCreateAccessList(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
@@ -128,7 +128,7 @@
 }
 
 func TestBinaryRootAccessList(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
@@ -412,7 +412,7 @@
 }
 
 func TestBinaryRationalStartingValueForGetPermissions(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	v23.GetNamespace(ctx).CacheCtl(naming.DisableCache(true))
 
diff --git a/services/mgmt/binary/impl/http_test.go b/services/mgmt/binary/impl/http_test.go
index 26009cc..4f7ab66 100644
--- a/services/mgmt/binary/impl/http_test.go
+++ b/services/mgmt/binary/impl/http_test.go
@@ -12,9 +12,9 @@
 	"v.io/v23/naming"
 	"v.io/v23/services/mgmt/repository"
 
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/services/mgmt/binary/impl"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 )
 
 // TestHTTP checks that HTTP download works.
diff --git a/services/mgmt/binary/impl/impl_test.go b/services/mgmt/binary/impl/impl_test.go
index c900944..5be4df2 100644
--- a/services/mgmt/binary/impl/impl_test.go
+++ b/services/mgmt/binary/impl/impl_test.go
@@ -17,11 +17,11 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/static"
 	"v.io/x/ref/services/mgmt/binary/impl"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 )
 
 const (
diff --git a/services/mgmt/binary/impl/util_test.go b/services/mgmt/binary/impl/util_test.go
index b50369d..fb34934 100644
--- a/services/mgmt/binary/impl/util_test.go
+++ b/services/mgmt/binary/impl/util_test.go
@@ -9,8 +9,8 @@
 	"v.io/v23/context"
 	"v.io/v23/services/mgmt/repository"
 
-	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/services/mgmt/binary/impl"
+	"v.io/x/ref/test/testutil"
 )
 
 // invokeUpload invokes the Upload RPC using the given client binary
diff --git a/services/mgmt/binary/impl/v23_test.go b/services/mgmt/binary/impl/v23_test.go
index a55f54f..bfab5a1 100644
--- a/services/mgmt/binary/impl/v23_test.go
+++ b/services/mgmt/binary/impl/v23_test.go
@@ -10,15 +10,15 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/modules"
 
 func init() {
 	modules.RegisterChild("binaryd", ``, binaryd)
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
diff --git a/services/mgmt/build/buildd/buildd_v23_test.go b/services/mgmt/build/buildd/buildd_v23_test.go
index 3fafbe7..bcbc423 100644
--- a/services/mgmt/build/buildd/buildd_v23_test.go
+++ b/services/mgmt/build/buildd/buildd_v23_test.go
@@ -9,8 +9,8 @@
 	"runtime"
 	"strings"
 
-	"v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/security"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/services/mgmt/build/buildd/v23_test.go b/services/mgmt/build/buildd/v23_test.go
index 1469093..6ec6ef0 100644
--- a/services/mgmt/build/buildd/v23_test.go
+++ b/services/mgmt/build/buildd/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/services/mgmt/build/impl/impl_test.go b/services/mgmt/build/impl/impl_test.go
index 2b9e0c6..0819687 100644
--- a/services/mgmt/build/impl/impl_test.go
+++ b/services/mgmt/build/impl/impl_test.go
@@ -12,8 +12,8 @@
 	"v.io/v23/context"
 	"v.io/v23/services/mgmt/build"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 //go:generate v23 test generate
@@ -112,7 +112,7 @@
 // TestSuccess checks that the build server successfully builds a
 // package that depends on the standard Go library.
 func TestSuccess(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	client := startServer(t, ctx)
@@ -147,7 +147,7 @@
 // TestEmpty checks that the build server successfully builds a
 // package that does not produce a binary.
 func TestEmpty(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	client := startServer(t, ctx)
@@ -182,7 +182,7 @@
 // TestFailure checks that the build server fails to build a package
 // consisting of an empty file.
 func TestFailure(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	client := startServer(t, ctx)
diff --git a/services/mgmt/build/impl/v23_internal_test.go b/services/mgmt/build/impl/v23_internal_test.go
index 73b1b67..f3c1179 100644
--- a/services/mgmt/build/impl/v23_internal_test.go
+++ b/services/mgmt/build/impl/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/services/mgmt/debug/dispatcher_test.go b/services/mgmt/debug/dispatcher_test.go
index d351d52..9dba828 100644
--- a/services/mgmt/debug/dispatcher_test.go
+++ b/services/mgmt/debug/dispatcher_test.go
@@ -24,9 +24,9 @@
 	"v.io/v23/vtrace"
 
 	libstats "v.io/x/ref/lib/stats"
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 )
 
 // startDebugServer starts a debug server.
diff --git a/services/mgmt/device/impl/app_service.go b/services/mgmt/device/impl/app_service.go
index 9045b6a..0087d16 100644
--- a/services/mgmt/device/impl/app_service.go
+++ b/services/mgmt/device/impl/app_service.go
@@ -526,7 +526,7 @@
 }
 
 // setupPrincipal sets up the instance's principal, with the right blessings.
-func setupPrincipal(ctx *context.T, instanceDir, blessingExtension string, call ipc.ServerCall, securityAgent *securityAgentState, info *instanceInfo) error {
+func setupPrincipal(ctx *context.T, instanceDir string, call device.ApplicationStartServerCall, securityAgent *securityAgentState, info *instanceInfo) error {
 	var p security.Principal
 	if securityAgent != nil {
 		// TODO(caprita): Part of the cleanup upon destroying an
@@ -553,27 +553,31 @@
 			return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("CreatePersistentPrincipal(%v, nil) failed: %v", credentialsDir, err))
 		}
 	}
-	dmPrincipal := call.LocalPrincipal()
-	// Take the blessings conferred upon us by the Start-er, extend them
-	// with the app title.
-	grantedBlessings := call.GrantedBlessings()
-	if grantedBlessings.IsZero() {
-		return verror.New(ErrInvalidBlessing, nil)
-	}
-	// TODO(caprita): Revisit UnconstrainedUse.
-	appBlessings, err := dmPrincipal.Bless(p.PublicKey(), grantedBlessings, blessingExtension, security.UnconstrainedUse())
+	mPubKey, err := p.PublicKey().MarshalBinary()
 	if err != nil {
-		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("Bless() failed: %v", err))
+		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("PublicKey().MarshalBinary() failed: %v", err))
 	}
-	// The blessings we extended from the blessings that the Start-er
-	// granted are the default blessings for the app.
-	if err := p.BlessingStore().SetDefault(appBlessings); err != nil {
+	if err := call.SendStream().Send(device.StartServerMessageInstancePublicKey{mPubKey}); err != nil {
+		return err
+	}
+	if !call.RecvStream().Advance() {
+		return verror.New(ErrInvalidBlessing, ctx, fmt.Sprintf("no blessings on stream: %v", call.RecvStream().Err()))
+	}
+	msg := call.RecvStream().Value()
+	appBlessings, ok := msg.(device.StartClientMessageAppBlessings)
+	if !ok {
+		return verror.New(ErrInvalidBlessing, ctx, fmt.Sprintf("wrong message type: %#v", msg))
+	}
+	if appBlessings.Value.IsZero() {
+		return verror.New(ErrInvalidBlessing, ctx)
+	}
+	if err := p.BlessingStore().SetDefault(appBlessings.Value); err != nil {
 		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("BlessingStore.SetDefault() failed: %v", err))
 	}
-	if _, err := p.BlessingStore().Set(appBlessings, security.AllPrincipals); err != nil {
+	if _, err := p.BlessingStore().Set(appBlessings.Value, security.AllPrincipals); err != nil {
 		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("BlessingStore.Set() failed: %v", err))
 	}
-	if err := p.AddToRoots(appBlessings); err != nil {
+	if err := p.AddToRoots(appBlessings.Value); err != nil {
 		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("AddToRoots() failed: %v", err))
 	}
 	// In addition, we give the app separate blessings for the purpose of
@@ -589,6 +593,7 @@
 	// TODO(caprita): Figure out if there is any feature value in providing
 	// the app with a device manager-derived blessing (e.g., may the app
 	// need to prove it's running on the device?).
+	dmPrincipal := call.LocalPrincipal()
 	dmBlessings, err := dmPrincipal.Bless(p.PublicKey(), dmPrincipal.BlessingStore().Default(), "callback", security.UnconstrainedUse())
 	// Put the names of the device manager's default blessings as patterns
 	// for the child, so that the child uses the right blessing when talking
@@ -667,7 +672,7 @@
 	return i.aclstore.Set(aclDir, acl, "")
 }
 
-func (i *appService) newInstance(call ipc.ServerCall) (string, string, error) {
+func (i *appService) newInstance(call device.ApplicationStartServerCall) (string, string, error) {
 	installationDir, err := i.installationDir()
 	if err != nil {
 		return "", "", err
@@ -679,7 +684,7 @@
 	instanceDir := filepath.Join(installationDir, "instances", instanceDirName(instanceID))
 	// Set permissions for app to have access.
 	if mkdirPerm(instanceDir, 0711) != nil {
-		return "", instanceID, verror.New(ErrOperationFailed, call.Context())
+		return "", "", verror.New(ErrOperationFailed, call.Context())
 	}
 	rootDir := filepath.Join(instanceDir, "root")
 	if err := mkdir(rootDir); err != nil {
@@ -696,26 +701,14 @@
 	}
 	versionLink := filepath.Join(instanceDir, "version")
 	if err := os.Symlink(versionDir, versionLink); err != nil {
-		return "", "", verror.New(ErrOperationFailed, call.Context(), fmt.Sprintf("Symlink(%v, %v) failed: %v", versionDir, versionLink, err))
+		return instanceDir, instanceID, verror.New(ErrOperationFailed, call.Context(), fmt.Sprintf("Symlink(%v, %v) failed: %v", versionDir, versionLink, err))
 	}
 	packagesDir, packagesLink := filepath.Join(versionLink, "packages"), filepath.Join(rootDir, "packages")
 	if err := os.Symlink(packagesDir, packagesLink); err != nil {
-		return "", "", verror.New(ErrOperationFailed, call.Context(), fmt.Sprintf("Symlink(%v, %v) failed: %v", packagesDir, packagesLink, err))
+		return instanceDir, instanceID, verror.New(ErrOperationFailed, call.Context(), fmt.Sprintf("Symlink(%v, %v) failed: %v", packagesDir, packagesLink, err))
 	}
 	instanceInfo := new(instanceInfo)
-	// Read the app installation version's envelope to obtain the app title,
-	// which we'll use as a blessing extension.
-	//
-	// NOTE: we could have gotten this from the suffix as well, but the
-	// format of the object name suffix may change in the future: there's no
-	// guarantee it will always include the title.
-	envelope, err := loadEnvelope(call.Context(), versionDir)
-	if err != nil {
-		return instanceDir, instanceID, err
-	}
-	// TODO(caprita): Using the app title as the blessing extension requires
-	// sanitizing to ensure no invalid blessing characters are used.
-	if err := setupPrincipal(call.Context(), instanceDir, envelope.Title, call, i.securityAgent, instanceInfo); err != nil {
+	if err := setupPrincipal(call.Context(), instanceDir, call, i.securityAgent, instanceInfo); err != nil {
 		return instanceDir, instanceID, err
 	}
 	if err := saveInstanceInfo(call.Context(), instanceDir, instanceInfo); err != nil {
@@ -920,31 +913,30 @@
 	return nil
 }
 
-func (i *appService) Start(call ipc.ServerCall) ([]string, error) {
+func (i *appService) Start(call device.ApplicationStartServerCall) error {
 	helper := i.config.Helper
 	instanceDir, instanceID, err := i.newInstance(call)
-
 	if err != nil {
 		cleanupDir(instanceDir, helper)
-		return nil, err
+		return err
 	}
 
 	systemName := suidHelper.usernameForPrincipal(call, i.uat)
 	if err := saveSystemNameForInstance(instanceDir, systemName); err != nil {
 		cleanupDir(instanceDir, helper)
-		return nil, err
+		return err
 	}
-
-	// For now, use the namespace roots of the device manager runtime to
-	// pass to the app.
+	if err := call.SendStream().Send(device.StartServerMessageInstanceName{instanceID}); err != nil {
+		return verror.New(ErrOperationFailed, call.Context(), err)
+	}
 	if err = i.run(call.Context(), instanceDir, systemName); err != nil {
 		// TODO(caprita): We should call cleanupDir here, but we don't
 		// in order to not lose the logs for the instance (so we can
 		// debug why run failed).  Clean this up.
 		// cleanupDir(instanceDir, helper)
-		return nil, err
+		return err
 	}
-	return []string{instanceID}, nil
+	return nil
 }
 
 // instanceDir returns the path to the directory containing the app instance
diff --git a/services/mgmt/device/impl/config_service.go b/services/mgmt/device/impl/config_service.go
index cce62bd..819cf28 100644
--- a/services/mgmt/device/impl/config_service.go
+++ b/services/mgmt/device/impl/config_service.go
@@ -41,8 +41,10 @@
 // callback mechanism for a given key.
 type callbackListener interface {
 	// waitForValue blocks until the value that this listener is expecting
-	// arrives; or until the timeout expires.
+	// arrives, until the timeout expires, or until stop() is called
 	waitForValue(timeout time.Duration) (string, error)
+	// stop makes waitForValue return early
+	stop()
 	// cleanup cleans up any state used by the listener.  Should be called
 	// when the listener is no longer needed.
 	cleanup()
@@ -53,10 +55,11 @@
 
 // listener implements callbackListener
 type listener struct {
-	id string
-	cs *callbackState
-	ch <-chan string
-	n  string
+	id      string
+	cs      *callbackState
+	ch      <-chan string
+	n       string
+	stopper chan struct{}
 }
 
 func (l *listener) waitForValue(timeout time.Duration) (string, error) {
@@ -65,9 +68,15 @@
 		return value, nil
 	case <-time.After(timeout):
 		return "", verror.New(ErrOperationFailed, nil, fmt.Sprintf("Waiting for callback timed out after %v", timeout))
+	case <-l.stopper:
+		return "", verror.New(ErrOperationFailed, nil, fmt.Sprintf("Stopped while waiting for callack"))
 	}
 }
 
+func (l *listener) stop() {
+	close(l.stopper)
+}
+
 func (l *listener) cleanup() {
 	l.cs.unregister(l.id)
 }
@@ -84,11 +93,13 @@
 	// unregisterCallbacks executes before Set is called.
 	callbackChan := make(chan string, 1)
 	c.register(id, key, callbackChan)
+	stopchan := make(chan struct{}, 1)
 	return &listener{
-		id: id,
-		cs: c,
-		ch: callbackChan,
-		n:  callbackName,
+		id:      id,
+		cs:      c,
+		ch:      callbackChan,
+		n:       callbackName,
+		stopper: stopchan,
 	}
 }
 
diff --git a/services/mgmt/device/impl/debug_acls_test.go b/services/mgmt/device/impl/debug_acls_test.go
index 924632f..56a167d 100644
--- a/services/mgmt/device/impl/debug_acls_test.go
+++ b/services/mgmt/device/impl/debug_acls_test.go
@@ -10,8 +10,8 @@
 	"v.io/v23/services/security/access"
 	"v.io/v23/vdl"
 
-	"v.io/x/ref/lib/testutil/testutil"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/test/testutil"
 )
 
 func updateAccessList(t *testing.T, ctx *context.T, blessing, right string, name ...string) {
diff --git a/services/mgmt/device/impl/device_service.go b/services/mgmt/device/impl/device_service.go
index 61c8ce4..801f657 100644
--- a/services/mgmt/device/impl/device_service.go
+++ b/services/mgmt/device/impl/device_service.go
@@ -396,10 +396,24 @@
 			vlog.Errorf("Clean() failed: %v", err)
 		}
 	}()
+
 	// Wait for the child process to start.
 	if err := handle.WaitForReady(childReadyTimeout); err != nil {
 		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("WaitForReady(%v) failed: %v", childReadyTimeout, err))
 	}
+
+	// Watch for the exit of the child. Failures could cause it to happen at any time
+	waitchan := make(chan error, 1)
+	go func() {
+		// Wait timeout needs to be long enough to give the rest of the operations time to run
+		err := handle.Wait(2*childReadyTimeout + childWaitTimeout)
+		if err != nil {
+			waitchan <- verror.New(ErrOperationFailed, ctx, fmt.Sprintf("new device manager failed to exit cleanly: %v", err))
+		}
+		close(waitchan)
+		listener.stop()
+	}()
+
 	childName, err := listener.waitForValue(childReadyTimeout)
 	if err != nil {
 		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("waitForValue(%v) failed: %v", childReadyTimeout, err))
@@ -410,8 +424,8 @@
 	if err := dmClient.Stop(ctx, 0); err != nil {
 		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("Stop() failed: %v", err))
 	}
-	if err := handle.Wait(childWaitTimeout); err != nil {
-		return verror.New(ErrOperationFailed, ctx, fmt.Sprintf("New device manager failed to exit cleanly: %v", err))
+	if err := <-waitchan; err != nil {
+		return err
 	}
 	return nil
 }
@@ -565,8 +579,8 @@
 	return err
 }
 
-func (*deviceService) Start(call ipc.ServerCall) ([]string, error) {
-	return nil, verror.New(ErrInvalidSuffix, call.Context())
+func (*deviceService) Start(call device.ApplicationStartServerCall) error {
+	return verror.New(ErrInvalidSuffix, call.Context())
 }
 
 func (*deviceService) Stop(call ipc.ServerCall, _ uint32) error {
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index 8bb0f3f..4a33582 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -27,6 +27,8 @@
 	"testing"
 	"time"
 
+	"v.io/x/lib/vlog"
+
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/ipc"
@@ -41,15 +43,9 @@
 	"v.io/v23/services/mgmt/stats"
 	"v.io/v23/services/security/access"
 	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/modules"
 	"v.io/x/ref/lib/signals"
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/expect"
-	tsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
 	binaryimpl "v.io/x/ref/services/mgmt/binary/impl"
 	"v.io/x/ref/services/mgmt/device/config"
 	"v.io/x/ref/services/mgmt/device/impl"
@@ -57,6 +53,11 @@
 	libbinary "v.io/x/ref/services/mgmt/lib/binary"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
 	suidhelper "v.io/x/ref/services/mgmt/suidhelper/impl"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/expect"
+	"v.io/x/ref/test/modules"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate .
@@ -455,15 +456,13 @@
 		t.Fatalf("script changed")
 	}
 
-	if false { // Disabled until we figure out how to make it not take 40 seconds to time out
-		// Try issuing an update with a binary that has a different major version number. It should fail
-		resolveExpectNotFound(t, ctx, "v2.5DM") // Ensure a clean slate.
-		*envelope = envelopeFromShell(sh, dmEnv, deviceManagerV10Cmd, application.DeviceManagerTitle, "v2.5DM")
-		updateDeviceExpectError(t, ctx, "v2DM", impl.ErrOperationFailed.ID)
+	// Try issuing an update with a binary that has a different major version number. It should fail
+	resolveExpectNotFound(t, ctx, "v2.5DM") // Ensure a clean slate.
+	*envelope = envelopeFromShell(sh, dmEnv, deviceManagerV10Cmd, application.DeviceManagerTitle, "v2.5DM")
+	updateDeviceExpectError(t, ctx, "v2DM", impl.ErrOperationFailed.ID)
 
-		if evalLink() != scriptPathV2 {
-			t.Fatalf("script changed")
-		}
+	if evalLink() != scriptPathV2 {
+		t.Fatalf("script changed")
 	}
 
 	// Create a third version of the device manager and issue an update.
@@ -682,15 +681,16 @@
 	}
 
 	// Start requires the caller to grant a blessing for the app instance.
-	if _, err := startAppImpl(t, ctx, appID, ""); err == nil || !verror.Is(err, impl.ErrInvalidBlessing.ID) {
-		t.Fatalf("Start(%v) expected to fail with %v, got %v instead", appID, impl.ErrInvalidBlessing.ID, err)
+	expectedErr := "bless failed"
+	if _, err := startAppImpl(t, ctx, appID, ""); err == nil || err.Error() != expectedErr {
+		t.Fatalf("Start(%v) expected to fail with %v, got %v instead", appID, expectedErr, err)
 	}
 
 	// Start an instance of the app.
 	instance1ID := startApp(t, ctx, appID)
 
 	instanceDebug := debug(t, ctx, appID, instance1ID)
-	if !strings.Contains(instanceDebug, fmt.Sprintf("Blessing Store: Default blessings: %s/forapp/google naps", test.TestBlessing)) {
+	if !strings.Contains(instanceDebug, fmt.Sprintf("Blessing Store: Default blessings: %s/forapp", test.TestBlessing)) {
 		t.Fatalf("debug response doesn't contain expected info: %v", instanceDebug)
 	}
 
diff --git a/services/mgmt/device/impl/proxy_invoker_test.go b/services/mgmt/device/impl/proxy_invoker_test.go
index dda6b38..eed3fc5 100644
--- a/services/mgmt/device/impl/proxy_invoker_test.go
+++ b/services/mgmt/device/impl/proxy_invoker_test.go
@@ -13,8 +13,8 @@
 
 	"v.io/x/lib/vlog"
 
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 )
 
 // TODO(toddw): Add tests of Signature and MethodSignature.
diff --git a/services/mgmt/device/impl/util_test.go b/services/mgmt/device/impl/util_test.go
index d29c2fb..07259dd 100644
--- a/services/mgmt/device/impl/util_test.go
+++ b/services/mgmt/device/impl/util_test.go
@@ -1,6 +1,8 @@
 package impl_test
 
 import (
+	"errors"
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -10,6 +12,8 @@
 	"testing"
 	"time"
 
+	"v.io/x/lib/vlog"
+
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/ipc"
@@ -20,15 +24,14 @@
 	"v.io/v23/services/mgmt/device"
 	"v.io/v23/services/mgmt/stats"
 	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 
-	"v.io/x/ref/lib/modules"
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles/roaming"
 	"v.io/x/ref/services/mgmt/device/impl"
 	mgmttest "v.io/x/ref/services/mgmt/lib/testutil"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/modules"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 )
 
 const (
@@ -215,18 +218,40 @@
 }
 
 func startAppImpl(t *testing.T, ctx *context.T, appID, grant string) (string, error) {
-	var opts []ipc.CallOpt
-	if grant != "" {
-		opts = append(opts, &granter{p: v23.GetPrincipal(ctx), extension: grant})
-	}
-	if instanceIDs, err := appStub(appID).Start(ctx, opts...); err != nil {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	call, err := appStub(appID).Start(ctx)
+	if err != nil {
 		return "", err
-	} else {
-		if want, got := 1, len(instanceIDs); want != got {
-			t.Fatalf(testutil.FormatLogLine(2, "Start(%v): expected %v instance ids, got %v instead", appID, want, got))
-		}
-		return instanceIDs[0], nil
 	}
+	var instanceIDs []string
+	for call.RecvStream().Advance() {
+		switch msg := call.RecvStream().Value().(type) {
+		case device.StartServerMessageInstanceName:
+			instanceIDs = append(instanceIDs, msg.Value)
+		case device.StartServerMessageInstancePublicKey:
+			p := v23.GetPrincipal(ctx)
+			pubKey, err := security.UnmarshalPublicKey(msg.Value)
+			if err != nil {
+				return "", err
+			}
+			blessings, err := p.Bless(pubKey, p.BlessingStore().Default(), grant, security.UnconstrainedUse())
+			if err != nil {
+				return "", errors.New("bless failed")
+			}
+			call.SendStream().Send(device.StartClientMessageAppBlessings{blessings})
+		default:
+			return "", fmt.Errorf("startAppImpl: received unexpected message: %#v", msg)
+		}
+	}
+	if err := call.Finish(); err != nil {
+		return "", err
+	}
+	if want, got := 1, len(instanceIDs); want != got {
+		t.Fatalf(testutil.FormatLogLine(2, "Start(%v): expected %v instance ids, got %v instead", appID, want, got))
+	}
+	return instanceIDs[0], nil
 }
 
 func startApp(t *testing.T, ctx *context.T, appID string) string {
diff --git a/services/mgmt/device/impl/v23_test.go b/services/mgmt/device/impl/v23_test.go
index aa08bfe..ddee652 100644
--- a/services/mgmt/device/impl/v23_test.go
+++ b/services/mgmt/device/impl/v23_test.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 package impl_test
 
-import "v.io/x/ref/lib/modules"
+import "v.io/x/ref/test/modules"
 
 func init() {
 	modules.RegisterChild("execScript", `execScript launches the script passed as argument.`, execScript)
diff --git a/services/mgmt/lib/binary/impl_test.go b/services/mgmt/lib/binary/impl_test.go
index ee15f1f..b62ce06 100644
--- a/services/mgmt/lib/binary/impl_test.go
+++ b/services/mgmt/lib/binary/impl_test.go
@@ -15,10 +15,10 @@
 	"v.io/v23/services/mgmt/repository"
 	"v.io/x/lib/vlog"
 
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/mgmt/binary/impl"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 )
 
 //go:generate v23 test generate
diff --git a/services/mgmt/lib/binary/v23_internal_test.go b/services/mgmt/lib/binary/v23_internal_test.go
index 1b128b9..fe3cb00 100644
--- a/services/mgmt/lib/binary/v23_internal_test.go
+++ b/services/mgmt/lib/binary/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/services/mgmt/lib/testutil/modules.go b/services/mgmt/lib/testutil/modules.go
index 7bdac3a..0b779a2 100644
--- a/services/mgmt/lib/testutil/modules.go
+++ b/services/mgmt/lib/testutil/modules.go
@@ -14,9 +14,9 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/modules/core"
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/modules/core"
+	"v.io/x/ref/test/testutil"
 )
 
 const (
diff --git a/services/mgmt/logreader/impl/logfile_test.go b/services/mgmt/logreader/impl/logfile_test.go
index 1a59233..ea88d66 100644
--- a/services/mgmt/logreader/impl/logfile_test.go
+++ b/services/mgmt/logreader/impl/logfile_test.go
@@ -6,10 +6,6 @@
 	"path"
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
-	_ "v.io/x/ref/profiles"
-	"v.io/x/ref/services/mgmt/logreader/impl"
-
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/ipc"
@@ -18,6 +14,10 @@
 	"v.io/v23/services/mgmt/logreader"
 	"v.io/v23/services/mgmt/logreader/types"
 	"v.io/v23/verror"
+
+	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/services/mgmt/logreader/impl"
+	"v.io/x/ref/test"
 )
 
 func startServer(t *testing.T, ctx *context.T, disp ipc.Dispatcher) (ipc.Server, string, error) {
@@ -62,7 +62,7 @@
 }
 
 func TestReadLogImplNoFollow(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	workdir, err := ioutil.TempDir("", "logreadertest")
@@ -149,7 +149,7 @@
 }
 
 func TestReadLogImplWithFollow(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	workdir, err := ioutil.TempDir("", "logreadertest")
diff --git a/services/mgmt/pprof/client/proxy_test.go b/services/mgmt/pprof/client/proxy_test.go
index f159add..14560f3 100644
--- a/services/mgmt/pprof/client/proxy_test.go
+++ b/services/mgmt/pprof/client/proxy_test.go
@@ -9,10 +9,10 @@
 	"v.io/v23"
 	"v.io/v23/security"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/mgmt/pprof/client"
 	"v.io/x/ref/services/mgmt/pprof/impl"
+	"v.io/x/ref/test"
 )
 
 type dispatcher struct {
@@ -24,7 +24,7 @@
 }
 
 func TestPProfProxy(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	s, err := v23.NewServer(ctx)
diff --git a/services/mgmt/profile/impl/impl_test.go b/services/mgmt/profile/impl/impl_test.go
index d5c0b42..ea1a183 100644
--- a/services/mgmt/profile/impl/impl_test.go
+++ b/services/mgmt/profile/impl/impl_test.go
@@ -10,10 +10,10 @@
 	"v.io/v23/naming"
 	"v.io/v23/services/mgmt/build"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/mgmt/profile"
 	"v.io/x/ref/services/mgmt/repository"
+	"v.io/x/ref/test"
 )
 
 var (
@@ -31,7 +31,7 @@
 // TestInterface tests that the implementation correctly implements
 // the Profile interface.
 func TestInterface(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	// Setup and start the profile repository server.
@@ -109,7 +109,7 @@
 }
 
 func TestPreserveAcrossRestarts(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	// Setup and start the profile repository server.
diff --git a/services/mgmt/profile/profiled/profiled_v23_test.go b/services/mgmt/profile/profiled/profiled_v23_test.go
index a7152a6..3ea6d36 100644
--- a/services/mgmt/profile/profiled/profiled_v23_test.go
+++ b/services/mgmt/profile/profiled/profiled_v23_test.go
@@ -5,7 +5,7 @@
 	"strings"
 
 	"v.io/v23/naming"
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/services/mgmt/profile/profiled/v23_test.go b/services/mgmt/profile/profiled/v23_test.go
index 6423f2f..cb53f83 100644
--- a/services/mgmt/profile/profiled/v23_test.go
+++ b/services/mgmt/profile/profiled/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/services/mgmt/stats/impl/stats_test.go b/services/mgmt/stats/impl/stats_test.go
index ca0b6f5..670eb8f 100644
--- a/services/mgmt/stats/impl/stats_test.go
+++ b/services/mgmt/stats/impl/stats_test.go
@@ -16,11 +16,11 @@
 
 	libstats "v.io/x/ref/lib/stats"
 	"v.io/x/ref/lib/stats/histogram"
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
 	_ "v.io/x/ref/profiles"
 	istats "v.io/x/ref/services/mgmt/stats"
 	"v.io/x/ref/services/mgmt/stats/impl"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/testutil"
 )
 
 type statsDispatcher struct {
diff --git a/services/mgmt/vtrace/impl/vtrace_test.go b/services/mgmt/vtrace/impl/vtrace_test.go
index f2f1321..155aeef 100644
--- a/services/mgmt/vtrace/impl/vtrace_test.go
+++ b/services/mgmt/vtrace/impl/vtrace_test.go
@@ -8,13 +8,13 @@
 	service "v.io/v23/services/mgmt/vtrace"
 	"v.io/v23/vtrace"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/mgmt/vtrace/impl"
+	"v.io/x/ref/test"
 )
 
 func TestVtraceServer(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	server, err := v23.NewServer(ctx)
diff --git a/services/mounttable/lib/mounttable_test.go b/services/mounttable/lib/mounttable_test.go
index fe40723..af8af91 100644
--- a/services/mounttable/lib/mounttable_test.go
+++ b/services/mounttable/lib/mounttable_test.go
@@ -18,9 +18,9 @@
 	"v.io/v23/services/security/access"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 // Simulate different processes with different runtimes.
@@ -415,7 +415,7 @@
 }
 
 func TestGlob(t *testing.T) {
-	rootCtx, shutdown := testutil.InitForTest()
+	rootCtx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -514,7 +514,7 @@
 }
 
 func TestCleanup(t *testing.T) {
-	rootCtx, shutdown := testutil.InitForTest()
+	rootCtx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -568,7 +568,7 @@
 }
 
 func TestServerFormat(t *testing.T) {
-	rootCtx, shutdown := testutil.InitForTest()
+	rootCtx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -582,7 +582,7 @@
 }
 
 func TestExpiry(t *testing.T) {
-	rootCtx, shutdown := testutil.InitForTest()
+	rootCtx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	server, estr := newMT(t, "", rootCtx)
@@ -663,8 +663,8 @@
 }
 
 func initTest() (rootCtx *context.T, aliceCtx *context.T, bobCtx *context.T, shutdown v23.Shutdown) {
-	testutil.Init()
-	ctx, shutdown := testutil.InitForTest()
+	test.Init()
+	ctx, shutdown := test.InitForTest()
 	var err error
 	if rootCtx, err = v23.SetPrincipal(ctx, tsecurity.NewPrincipal("root")); err != nil {
 		panic("failed to set root principal")
diff --git a/services/mounttable/lib/neighborhood_test.go b/services/mounttable/lib/neighborhood_test.go
index 4a4f298..71802e2 100644
--- a/services/mounttable/lib/neighborhood_test.go
+++ b/services/mounttable/lib/neighborhood_test.go
@@ -12,8 +12,8 @@
 	"v.io/v23/options"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 //go:generate v23 test generate
@@ -27,7 +27,7 @@
 }
 
 func TestNeighborhood(t *testing.T) {
-	rootCtx, shutdown := testutil.InitForTest()
+	rootCtx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	vlog.Infof("TestNeighborhood")
diff --git a/services/mounttable/lib/v23_internal_test.go b/services/mounttable/lib/v23_internal_test.go
index 75af1c0..8b6b541 100644
--- a/services/mounttable/lib/v23_internal_test.go
+++ b/services/mounttable/lib/v23_internal_test.go
@@ -9,9 +9,9 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
+import "v.io/x/ref/test"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	os.Exit(m.Run())
 }
diff --git a/services/mounttable/mounttabled/mounttabled_v23_test.go b/services/mounttable/mounttabled/mounttabled_v23_test.go
index 115976a..9537309 100644
--- a/services/mounttable/mounttabled/mounttabled_v23_test.go
+++ b/services/mounttable/mounttabled/mounttabled_v23_test.go
@@ -5,7 +5,7 @@
 	"os"
 	"regexp"
 
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
diff --git a/services/mounttable/mounttabled/v23_test.go b/services/mounttable/mounttabled/v23_test.go
index 94882ef..0d570e3 100644
--- a/services/mounttable/mounttabled/v23_test.go
+++ b/services/mounttable/mounttabled/v23_test.go
@@ -9,11 +9,11 @@
 import "testing"
 import "os"
 
-import "v.io/x/ref/lib/testutil"
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test"
+import "v.io/x/ref/test/v23tests"
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	cleanup := v23tests.UseSharedBinDir()
 	r := m.Run()
 	cleanup()
diff --git a/services/security/groups/server/server_test.go b/services/security/groups/server/server_test.go
index 2a0cdee..35bdb9b 100644
--- a/services/security/groups/server/server_test.go
+++ b/services/security/groups/server/server_test.go
@@ -14,10 +14,10 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/security/groups/memstore"
 	"v.io/x/ref/services/security/groups/server"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 func getEntriesOrDie(g groups.GroupClientStub, ctx *context.T, t *testing.T) map[groups.BlessingPatternChunk]struct{} {
diff --git a/services/wsprd/app/app_test.go b/services/wsprd/app/app_test.go
index b32436c..fa51687 100644
--- a/services/wsprd/app/app_test.go
+++ b/services/wsprd/app/app_test.go
@@ -21,15 +21,15 @@
 	"v.io/v23/vom"
 	"v.io/v23/vtrace"
 
-	test "v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
 	"v.io/x/ref/profiles"
 	vsecurity "v.io/x/ref/security"
 	mounttable "v.io/x/ref/services/mounttable/lib"
 	"v.io/x/ref/services/wsprd/ipc/server"
 	"v.io/x/ref/services/wsprd/lib"
 	"v.io/x/ref/services/wsprd/lib/testwriter"
+	"v.io/x/ref/test"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 )
 
 var (
diff --git a/services/wsprd/browspr/browspr_account_test.go b/services/wsprd/browspr/browspr_account_test.go
index a1e39ba..a8dfac5 100644
--- a/services/wsprd/browspr/browspr_account_test.go
+++ b/services/wsprd/browspr/browspr_account_test.go
@@ -10,8 +10,8 @@
 	"v.io/v23/security"
 	"v.io/v23/vdl"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 const topLevelName = "mock-blesser"
@@ -39,7 +39,7 @@
 }
 
 func setup(t *testing.T) (*Browspr, func()) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 
 	spec := v23.GetListenSpec(ctx)
 	spec.Proxy = "/mock/proxy"
diff --git a/services/wsprd/browspr/browspr_test.go b/services/wsprd/browspr/browspr_test.go
index 90b130c..7c037bf 100644
--- a/services/wsprd/browspr/browspr_test.go
+++ b/services/wsprd/browspr/browspr_test.go
@@ -17,11 +17,11 @@
 	vdltime "v.io/v23/vdlroot/time"
 	"v.io/v23/vom"
 
-	"v.io/x/ref/lib/testutil"
 	"v.io/x/ref/profiles"
 	mounttable "v.io/x/ref/services/mounttable/lib"
 	"v.io/x/ref/services/wsprd/app"
 	"v.io/x/ref/services/wsprd/lib"
+	"v.io/x/ref/test"
 )
 
 func startMounttable(ctx *context.T) (ipc.Server, naming.Endpoint, error) {
@@ -73,7 +73,7 @@
 }
 
 func TestBrowspr(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	proxyShutdown, proxyEndpoint, err := profiles.NewProxy(ctx, "tcp", "127.0.0.1:0", "")
diff --git a/services/wsprd/ipc/server/server.go b/services/wsprd/ipc/server/server.go
index bc5e9b1..25fbdf2 100644
--- a/services/wsprd/ipc/server/server.go
+++ b/services/wsprd/ipc/server/server.go
@@ -333,7 +333,7 @@
 // It resolves each []security.Caveat in cavs to an error (or nil) and collects them in a slice.
 // TODO(ataly, ashankar, bprosnitz): Update this method so tha it also conveys the CallSide to
 // JavaScript.
-func (s *Server) wsprCaveatValidator(call security.Call, _ security.CallSide, cavs [][]security.Caveat) []error {
+func (s *Server) validateCavsInJavascript(call security.Call, _ security.CallSide, cavs [][]security.Caveat) []error {
 	flow := s.helper.CreateNewFlow(s, nil)
 	req := CaveatValidationRequest{
 		Call: s.convertSecurityCall(call, false),
@@ -376,6 +376,61 @@
 	}
 }
 
+// wsprCaveatValidator validates caveats for javascript.
+// Certain caveats (PublicKeyThirdPartyCaveatX) are intercepted and handled in go.
+// This call validateCavsInJavascript to process the remaining caveats in javascript.
+func (s *Server) wsprCaveatValidator(call security.Call, callSide security.CallSide, cavs [][]security.Caveat) []error {
+	type validationStatus struct {
+		err   error
+		isSet bool
+	}
+	valStatus := make([]validationStatus, len(cavs))
+
+	var caveatChainsToValidate [][]security.Caveat
+nextCav:
+	for i, chainCavs := range cavs {
+		var newChainCavs []security.Caveat
+		for _, cav := range chainCavs {
+			switch cav.Id {
+			case security.PublicKeyThirdPartyCaveatX.Id:
+				res := cav.Validate(call, callSide)
+				if res != nil {
+					valStatus[i] = validationStatus{
+						err:   res,
+						isSet: true,
+					}
+					continue nextCav
+				}
+			default:
+				newChainCavs = append(newChainCavs, cav)
+			}
+		}
+		if len(newChainCavs) == 0 {
+			valStatus[i] = validationStatus{
+				err:   nil,
+				isSet: true,
+			}
+		} else {
+			caveatChainsToValidate = append(caveatChainsToValidate, newChainCavs)
+		}
+	}
+
+	jsRes := s.validateCavsInJavascript(call, callSide, caveatChainsToValidate)
+
+	outResults := make([]error, len(cavs))
+	jsIndex := 0
+	for i, status := range valStatus {
+		if status.isSet {
+			outResults[i] = status.err
+		} else {
+			outResults[i] = jsRes[jsIndex]
+			jsIndex++
+		}
+	}
+
+	return outResults
+}
+
 func (s *Server) convertSecurityCall(call security.Call, includeBlessingStrings bool) SecurityCall {
 	// TODO(bprosnitz) Local/Remote Endpoint should always be non-nil, but isn't
 	// due to a TODO in vc/auth.go
diff --git a/services/wsprd/lib/signature_manager_test.go b/services/wsprd/lib/signature_manager_test.go
index 27e624e..69fcee3 100644
--- a/services/wsprd/lib/signature_manager_test.go
+++ b/services/wsprd/lib/signature_manager_test.go
@@ -9,8 +9,8 @@
 	"v.io/v23/context"
 	"v.io/v23/vdl"
 	"v.io/v23/vdlroot/signature"
-	"v.io/x/ref/lib/testutil"
 	"v.io/x/ref/profiles/fake"
+	"v.io/x/ref/test"
 )
 
 const (
@@ -18,7 +18,7 @@
 )
 
 func initContext(t *testing.T) (*context.T, clientWithTimesCalled, v23.Shutdown) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	initialSig := []signature.Interface{
 		{
 			Methods: []signature.Method{
diff --git a/lib/testutil/benchmark/stats.go b/test/benchmark/stats.go
similarity index 100%
rename from lib/testutil/benchmark/stats.go
rename to test/benchmark/stats.go
diff --git a/lib/testutil/benchmark/stats_test.go b/test/benchmark/stats_test.go
similarity index 93%
rename from lib/testutil/benchmark/stats_test.go
rename to test/benchmark/stats_test.go
index d315f67..05236ae 100644
--- a/lib/testutil/benchmark/stats_test.go
+++ b/test/benchmark/stats_test.go
@@ -5,7 +5,7 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/testutil/benchmark"
+	"v.io/x/ref/test/benchmark"
 )
 
 func TestStatsBasic(t *testing.T) {
diff --git a/lib/testutil/benchmark/util.go b/test/benchmark/util.go
similarity index 100%
rename from lib/testutil/benchmark/util.go
rename to test/benchmark/util.go
diff --git a/lib/testutil/benchmark/util_test.go b/test/benchmark/util_test.go
similarity index 100%
rename from lib/testutil/benchmark/util_test.go
rename to test/benchmark/util_test.go
diff --git a/lib/testutil/doc.go b/test/doc.go
similarity index 76%
rename from lib/testutil/doc.go
rename to test/doc.go
index ded0c07..a2bbe20 100644
--- a/lib/testutil/doc.go
+++ b/test/doc.go
@@ -3,9 +3,9 @@
 // Configures logging, random number generators and other global state.
 // Typical usage in _test.go files:
 //
-// import "v.io/x/ref/lib/testutil"
+// import "v.io/x/ref/test"
 // func TestMain(m *testing.M) {
-//     testutil.Init()
+//     test.Init()
 //     os.Exit(m.Run())
 // }
 //
@@ -13,8 +13,8 @@
 // to v23.Init.
 //
 // func TestFoo(t *testing.T) {
-//    ctx, shutdown := testutil.InitForTest()
+//    ctx, shutdown := test.InitForTest()
 //    defer shutdown()
 //    ...
 // }
-package testutil
+package test
diff --git a/lib/testutil/expect/expect.go b/test/expect/expect.go
similarity index 100%
rename from lib/testutil/expect/expect.go
rename to test/expect/expect.go
diff --git a/lib/testutil/expect/expect_test.go b/test/expect/expect_test.go
similarity index 99%
rename from lib/testutil/expect/expect_test.go
rename to test/expect/expect_test.go
index 46f6223..beedd85 100644
--- a/lib/testutil/expect/expect_test.go
+++ b/test/expect/expect_test.go
@@ -9,7 +9,7 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/testutil/expect"
+	"v.io/x/ref/test/expect"
 )
 
 func TestSimple(t *testing.T) {
diff --git a/lib/testutil/init.go b/test/init.go
similarity index 94%
rename from lib/testutil/init.go
rename to test/init.go
index 9276f44..8aaf013 100644
--- a/lib/testutil/init.go
+++ b/test/init.go
@@ -1,4 +1,4 @@
-package testutil
+package test
 
 import (
 	"flag"
@@ -11,8 +11,8 @@
 
 	"v.io/x/lib/vlog"
 
-	tsecurity "v.io/x/ref/lib/testutil/security"
-	"v.io/x/ref/lib/testutil/testutil"
+	tsecurity "v.io/x/ref/test/security"
+	"v.io/x/ref/test/testutil"
 )
 
 const (
diff --git a/lib/modules/core/core.go b/test/modules/core/core.go
similarity index 100%
rename from lib/modules/core/core.go
rename to test/modules/core/core.go
diff --git a/lib/modules/core/core_internal_test.go b/test/modules/core/core_internal_test.go
similarity index 100%
rename from lib/modules/core/core_internal_test.go
rename to test/modules/core/core_internal_test.go
diff --git a/lib/modules/core/core_test.go b/test/modules/core/core_test.go
similarity index 97%
rename from lib/modules/core/core_test.go
rename to test/modules/core/core_test.go
index 559d611..9ebecb8 100644
--- a/lib/modules/core/core_test.go
+++ b/test/modules/core/core_test.go
@@ -12,16 +12,16 @@
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/modules/core"
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/modules/core"
 )
 
 // We create our own TestMain here because v23 test generate currently does not
 // recognize that this requires modules.Dispatch().
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
@@ -45,7 +45,7 @@
 // TODO(cnicolaou): add test for proxyd
 
 func newShell(t *testing.T) (*modules.Shell, func()) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	sh, err := modules.NewExpectShell(ctx, nil, t, testing.Verbose())
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
diff --git a/lib/modules/core/echo.go b/test/modules/core/echo.go
similarity index 98%
rename from lib/modules/core/echo.go
rename to test/modules/core/echo.go
index e8a3809..efff29a 100644
--- a/lib/modules/core/echo.go
+++ b/test/modules/core/echo.go
@@ -10,7 +10,7 @@
 	"v.io/v23/ipc"
 	"v.io/v23/security"
 
-	"v.io/x/ref/lib/modules"
+	"v.io/x/ref/test/modules"
 )
 
 func init() {
diff --git a/lib/modules/core/misc.go b/test/modules/core/misc.go
similarity index 97%
rename from lib/modules/core/misc.go
rename to test/modules/core/misc.go
index 580b39b..4a6d547 100644
--- a/lib/modules/core/misc.go
+++ b/test/modules/core/misc.go
@@ -5,7 +5,7 @@
 	"io"
 	"time"
 
-	"v.io/x/ref/lib/modules"
+	"v.io/x/ref/test/modules"
 )
 
 func init() {
diff --git a/lib/modules/core/mounttable.go b/test/modules/core/mounttable.go
similarity index 98%
rename from lib/modules/core/mounttable.go
rename to test/modules/core/mounttable.go
index 9752635..4e7c335 100644
--- a/lib/modules/core/mounttable.go
+++ b/test/modules/core/mounttable.go
@@ -11,8 +11,8 @@
 	"v.io/v23/naming"
 	"v.io/v23/options"
 
-	"v.io/x/ref/lib/modules"
 	mounttable "v.io/x/ref/services/mounttable/lib"
+	"v.io/x/ref/test/modules"
 )
 
 var details *bool
diff --git a/lib/modules/core/test_identityd.go b/test/modules/core/test_identityd.go
similarity index 98%
rename from lib/modules/core/test_identityd.go
rename to test/modules/core/test_identityd.go
index 7ef34de..9f4b657 100644
--- a/lib/modules/core/test_identityd.go
+++ b/test/modules/core/test_identityd.go
@@ -10,8 +10,6 @@
 
 	"v.io/v23"
 
-	"v.io/x/ref/lib/modules"
-
 	"v.io/x/ref/services/identity/auditor"
 	"v.io/x/ref/services/identity/blesser"
 	"v.io/x/ref/services/identity/caveats"
@@ -19,6 +17,7 @@
 	"v.io/x/ref/services/identity/revocation"
 	"v.io/x/ref/services/identity/server"
 	"v.io/x/ref/services/identity/util"
+	"v.io/x/ref/test/modules"
 )
 
 var (
diff --git a/lib/modules/core/util.go b/test/modules/core/util.go
similarity index 100%
rename from lib/modules/core/util.go
rename to test/modules/core/util.go
diff --git a/lib/modules/core/wspr.go b/test/modules/core/wspr.go
similarity index 96%
rename from lib/modules/core/wspr.go
rename to test/modules/core/wspr.go
index 29ef5e8..9463776 100644
--- a/lib/modules/core/wspr.go
+++ b/test/modules/core/wspr.go
@@ -5,8 +5,8 @@
 	"fmt"
 	"io"
 
-	"v.io/x/ref/lib/modules"
 	"v.io/x/ref/services/wsprd/wspr"
+	"v.io/x/ref/test/modules"
 
 	"v.io/v23"
 )
diff --git a/lib/modules/examples_test.go b/test/modules/examples_test.go
similarity index 88%
rename from lib/modules/examples_test.go
rename to test/modules/examples_test.go
index f9ae282..9fd1f24 100644
--- a/lib/modules/examples_test.go
+++ b/test/modules/examples_test.go
@@ -5,8 +5,8 @@
 	"io"
 	"os"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/modules"
 )
 
 func init() {
@@ -21,7 +21,7 @@
 }
 
 func ExampleDispatch() {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	if modules.IsModulesChildProcess() {
 		// Child process. Dispatch will invoke the 'echo' command
@@ -41,7 +41,7 @@
 }
 
 func ExampleDispatchAndExit() {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	// DispatchAndExit will call os.Exit(0) when executed within the child.
 	modules.DispatchAndExit()
diff --git a/lib/modules/exec.go b/test/modules/exec.go
similarity index 99%
rename from lib/modules/exec.go
rename to test/modules/exec.go
index ad494fc..d6dedc9 100644
--- a/lib/modules/exec.go
+++ b/test/modules/exec.go
@@ -13,7 +13,7 @@
 	"v.io/v23/mgmt"
 	"v.io/x/lib/vlog"
 	vexec "v.io/x/ref/lib/exec"
-	"v.io/x/ref/lib/testutil/expect"
+	"v.io/x/ref/test/expect"
 )
 
 // execHandle implements both the command and Handle interfaces.
diff --git a/lib/modules/func.go b/test/modules/func.go
similarity index 98%
rename from lib/modules/func.go
rename to test/modules/func.go
index ff0ebd9..e251469 100644
--- a/lib/modules/func.go
+++ b/test/modules/func.go
@@ -8,7 +8,7 @@
 	"time"
 
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/lib/testutil/expect"
+	"v.io/x/ref/test/expect"
 )
 
 type pipe struct {
diff --git a/lib/modules/modules_internal_test.go b/test/modules/modules_internal_test.go
similarity index 94%
rename from lib/modules/modules_internal_test.go
rename to test/modules/modules_internal_test.go
index 678608a..38ef18e 100644
--- a/lib/modules/modules_internal_test.go
+++ b/test/modules/modules_internal_test.go
@@ -7,8 +7,8 @@
 	"runtime"
 	"testing"
 
-	"v.io/x/ref/lib/testutil"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
 )
 
 func Echo(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
@@ -29,7 +29,7 @@
 }
 
 func TestState(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 
 	defer shutdown()
 
diff --git a/lib/modules/modules_test.go b/test/modules/modules_test.go
similarity index 95%
rename from lib/modules/modules_test.go
rename to test/modules/modules_test.go
index 9a8c8b0..181687a 100644
--- a/lib/modules/modules_test.go
+++ b/test/modules/modules_test.go
@@ -15,16 +15,15 @@
 	"testing"
 	"time"
 
+	"v.io/v23"
+
 	"v.io/x/ref/lib/exec"
 	execconsts "v.io/x/ref/lib/exec/consts"
-
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/security"
 	_ "v.io/x/ref/profiles"
-
-	"v.io/v23"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/security"
 )
 
 const credentialsEnvPrefix = "\"" + consts.VeyronCredentials + "="
@@ -48,7 +47,7 @@
 // We must call Testmain ourselves because using v23 test generate
 // creates an import cycle for this package.
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	if modules.IsModulesChildProcess() {
 		if err := modules.Dispatch(); err != nil {
 			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
@@ -90,7 +89,7 @@
 }
 
 func PrintBlessing(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	blessing := v23.GetPrincipal(ctx).BlessingStore().Default()
@@ -204,7 +203,7 @@
 }
 
 func TestChild(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -218,7 +217,7 @@
 }
 
 func TestAgent(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -234,7 +233,7 @@
 }
 
 func TestCustomPrincipal(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	p := security.NewPrincipal("myshell")
@@ -255,7 +254,7 @@
 }
 
 func TestCustomCredentials(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	root := security.NewIDProvider("myshell")
@@ -319,7 +318,7 @@
 }
 
 func TestChildNoRegistration(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	//fmt.Fprintf(os.Stderr, "B\n")
@@ -339,7 +338,7 @@
 }
 
 func TestFunction(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -353,7 +352,7 @@
 }
 
 func TestErrorChild(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -396,7 +395,7 @@
 }
 
 func TestShutdownSubprocess(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -411,7 +410,7 @@
 // forever if a child does not die upon closing stdin; but instead times out and
 // returns an appropriate error.
 func TestShutdownSubprocessIgnoresStdin(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -440,7 +439,7 @@
 // implementation inappropriately sets stdout to the file that is to be closed
 // in Wait.
 func TestStdoutRace(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -476,7 +475,7 @@
 }
 
 func TestShutdownFunction(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -488,7 +487,7 @@
 }
 
 func TestErrorFunc(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -515,7 +514,7 @@
 }
 
 func TestEnvelope(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -570,7 +569,7 @@
 }
 
 func TestEnvMerge(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -619,7 +618,7 @@
 }
 
 func TestNoExec(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -639,7 +638,7 @@
 }
 
 func TestExternal(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -677,7 +676,7 @@
 }
 
 func TestPipe(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 
 	sh, err := modules.NewShell(ctx, nil)
@@ -727,7 +726,7 @@
 }
 
 func TestLIFO(t *testing.T) {
-	ctx, shutdown := testutil.InitForTest()
+	ctx, shutdown := test.InitForTest()
 	defer shutdown()
 	sh, err := modules.NewShell(ctx, nil)
 	if err != nil {
diff --git a/lib/modules/only_for_test.go b/test/modules/only_for_test.go
similarity index 100%
rename from lib/modules/only_for_test.go
rename to test/modules/only_for_test.go
diff --git a/lib/modules/queue_rw.go b/test/modules/queue_rw.go
similarity index 100%
rename from lib/modules/queue_rw.go
rename to test/modules/queue_rw.go
diff --git a/lib/modules/queue_rw_test.go b/test/modules/queue_rw_test.go
similarity index 93%
rename from lib/modules/queue_rw_test.go
rename to test/modules/queue_rw_test.go
index b7e618c..b4cb522 100644
--- a/lib/modules/queue_rw_test.go
+++ b/test/modules/queue_rw_test.go
@@ -5,8 +5,8 @@
 	"io"
 	"testing"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil/testutil"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/testutil"
 )
 
 func TestQueueRW(t *testing.T) {
diff --git a/lib/modules/registry.go b/test/modules/registry.go
similarity index 100%
rename from lib/modules/registry.go
rename to test/modules/registry.go
diff --git a/lib/modules/shell.go b/test/modules/shell.go
similarity index 99%
rename from lib/modules/shell.go
rename to test/modules/shell.go
index 390a7f6..08ccdab 100644
--- a/lib/modules/shell.go
+++ b/test/modules/shell.go
@@ -147,9 +147,9 @@
 	"v.io/v23/security"
 	"v.io/x/ref/lib/exec"
 	"v.io/x/ref/lib/flags/consts"
-	"v.io/x/ref/lib/testutil/expect"
 	"v.io/x/ref/security/agent"
 	"v.io/x/ref/security/agent/keymgr"
+	"v.io/x/ref/test/expect"
 )
 
 const (
@@ -721,7 +721,7 @@
 	return r, nil
 }
 
-// ExpectSession is a subset of v.io/x/ref/lib/testutil/expect.Session's methods
+// ExpectSession is a subset of v.io/x/ref/tests/expect.Session's methods
 // that are embedded in Handle.
 type ExpectSession interface {
 	Expect(expected string)
diff --git a/lib/modules/util.go b/test/modules/util.go
similarity index 100%
rename from lib/modules/util.go
rename to test/modules/util.go
diff --git a/lib/testutil/security/util.go b/test/security/util.go
similarity index 100%
rename from lib/testutil/security/util.go
rename to test/security/util.go
diff --git a/lib/testutil/security/util_test.go b/test/security/util_test.go
similarity index 100%
rename from lib/testutil/security/util_test.go
rename to test/security/util_test.go
diff --git a/lib/testutil/testutil/dispatcher.go b/test/testutil/dispatcher.go
similarity index 100%
rename from lib/testutil/testutil/dispatcher.go
rename to test/testutil/dispatcher.go
diff --git a/lib/testutil/testutil/glob.go b/test/testutil/glob.go
similarity index 100%
rename from lib/testutil/testutil/glob.go
rename to test/testutil/glob.go
diff --git a/lib/testutil/testutil/rand.go b/test/testutil/rand.go
similarity index 100%
rename from lib/testutil/testutil/rand.go
rename to test/testutil/rand.go
diff --git a/lib/testutil/testutil/util.go b/test/testutil/util.go
similarity index 100%
rename from lib/testutil/testutil/util.go
rename to test/testutil/util.go
diff --git a/lib/testutil/testutil/util_test.go b/test/testutil/util_test.go
similarity index 100%
rename from lib/testutil/testutil/util_test.go
rename to test/testutil/util_test.go
diff --git a/lib/testutil/testutil/vtest.go b/test/testutil/vtest.go
similarity index 100%
rename from lib/testutil/testutil/vtest.go
rename to test/testutil/vtest.go
diff --git a/lib/testutil/testutil/vtest_test.go b/test/testutil/vtest_test.go
similarity index 100%
rename from lib/testutil/testutil/vtest_test.go
rename to test/testutil/vtest_test.go
diff --git a/lib/testutil/timekeeper/manual_time.go b/test/timekeeper/manual_time.go
similarity index 100%
rename from lib/testutil/timekeeper/manual_time.go
rename to test/timekeeper/manual_time.go
diff --git a/lib/testutil/timekeeper/manual_time_test.go b/test/timekeeper/manual_time_test.go
similarity index 100%
rename from lib/testutil/timekeeper/manual_time_test.go
rename to test/timekeeper/manual_time_test.go
diff --git a/lib/testutil/v23tests/binary.go b/test/v23tests/binary.go
similarity index 98%
rename from lib/testutil/v23tests/binary.go
rename to test/v23tests/binary.go
index 8a34960..92ed21e 100644
--- a/lib/testutil/v23tests/binary.go
+++ b/test/v23tests/binary.go
@@ -9,7 +9,7 @@
 
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/modules"
+	"v.io/x/ref/test/modules"
 )
 
 // Binary represents an executable program that will be executed during a
diff --git a/lib/testutil/v23tests/internal/cached_test.go b/test/v23tests/internal/cached_test.go
similarity index 94%
rename from lib/testutil/v23tests/internal/cached_test.go
rename to test/v23tests/internal/cached_test.go
index 6a8127d..2b6672c 100644
--- a/lib/testutil/v23tests/internal/cached_test.go
+++ b/test/v23tests/internal/cached_test.go
@@ -9,9 +9,9 @@
 	"testing"
 	"time"
 
-	"v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/v23tests"
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/v23tests"
 )
 
 //go:generate v23 test generate
@@ -86,7 +86,7 @@
 }
 
 func TestMain(m *testing.M) {
-	testutil.Init()
+	test.Init()
 	r := m.Run()
 	if len(tmpDir) > 0 {
 		os.RemoveAll(tmpDir)
diff --git a/lib/testutil/v23tests/internal/dummy.go b/test/v23tests/internal/dummy.go
similarity index 100%
rename from lib/testutil/v23tests/internal/dummy.go
rename to test/v23tests/internal/dummy.go
diff --git a/lib/testutil/v23tests/internal/v23_test.go b/test/v23tests/internal/v23_test.go
similarity index 92%
rename from lib/testutil/v23tests/internal/v23_test.go
rename to test/v23tests/internal/v23_test.go
index fdcea7a..87514d1 100644
--- a/lib/testutil/v23tests/internal/v23_test.go
+++ b/test/v23tests/internal/v23_test.go
@@ -8,7 +8,7 @@
 
 import "testing"
 
-import "v.io/x/ref/lib/testutil/v23tests"
+import "v.io/x/ref/test/v23tests"
 
 func TestV23One(t *testing.T) {
 	v23tests.RunTest(t, V23TestOne)
diff --git a/lib/testutil/v23tests/invocation.go b/test/v23tests/invocation.go
similarity index 98%
rename from lib/testutil/v23tests/invocation.go
rename to test/v23tests/invocation.go
index 8879aa3..3f30c79 100644
--- a/lib/testutil/v23tests/invocation.go
+++ b/test/v23tests/invocation.go
@@ -8,7 +8,7 @@
 
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/modules"
+	"v.io/x/ref/test/modules"
 )
 
 // Invocation represents a single invocation of a Binary.
diff --git a/lib/testutil/v23tests/v23tests.go b/test/v23tests/v23tests.go
similarity index 98%
rename from lib/testutil/v23tests/v23tests.go
rename to test/v23tests/v23tests.go
index e71a0c8..9c0df9c 100644
--- a/lib/testutil/v23tests/v23tests.go
+++ b/test/v23tests/v23tests.go
@@ -84,14 +84,15 @@
 	"testing"
 	"time"
 
-	"v.io/v23"
-	"v.io/v23/security"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil"
-	tsecurity "v.io/x/ref/lib/testutil/security"
+	"v.io/v23"
+	"v.io/v23/security"
+
 	"v.io/x/ref/security/agent"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/modules"
+	tsecurity "v.io/x/ref/test/security"
 )
 
 // TB is an exact mirror of testing.TB. It is provided to allow for testing
@@ -275,7 +276,7 @@
 // then it will run a debug shell before cleaning up its state.
 func (t *T) Cleanup() {
 	if t.Failed() {
-		if testutil.IntegrationTestsDebugShellOnError {
+		if test.IntegrationTestsDebugShellOnError {
 			t.DebugSystemShell()
 		}
 		// Print out a summary of the invocations and their status.
@@ -627,7 +628,7 @@
 
 // RunTest runs a single Vanadium 'v23 style' integration test.
 func RunTest(t *testing.T, fn func(i *T)) {
-	if !testutil.IntegrationTestsEnabled {
+	if !test.IntegrationTestsEnabled {
 		t.Skip()
 	}
 	i := New(t)
diff --git a/lib/testutil/v23tests/v23tests_test.go b/test/v23tests/v23tests_test.go
similarity index 95%
rename from lib/testutil/v23tests/v23tests_test.go
rename to test/v23tests/v23tests_test.go
index 448b51f..3acd20e 100644
--- a/lib/testutil/v23tests/v23tests_test.go
+++ b/test/v23tests/v23tests_test.go
@@ -12,15 +12,16 @@
 	"testing"
 	"time"
 
-	"v.io/v23/naming"
-	"v.io/v23/security"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/lib/modules"
-	test "v.io/x/ref/lib/testutil"
-	"v.io/x/ref/lib/testutil/testutil"
-	"v.io/x/ref/lib/testutil/v23tests"
+	"v.io/v23/naming"
+	"v.io/v23/security"
+
 	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/test"
+	"v.io/x/ref/test/modules"
+	"v.io/x/ref/test/testutil"
+	"v.io/x/ref/test/v23tests"
 )
 
 func TestBinaryFromPath(t *testing.T) {
@@ -279,7 +280,7 @@
 		msg := recover().(string)
 		// this, and the tests below are intended to ensure that line #s
 		// are captured and reported correctly.
-		if got, want := msg, "v23tests_test.go:289"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:290"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "fork/exec /bin/echox: no such file or directory"; !strings.Contains(got, want) {
@@ -301,7 +302,7 @@
 	sh.SetDefaultStartOpts(opts)
 	defer func() {
 		msg := recover().(string)
-		if got, want := msg, "v23tests_test.go:311"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:312"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "StartWithOpts"; !strings.Contains(got, want) {
@@ -325,7 +326,7 @@
 		if iterations == 0 {
 			t.Fatalf("our sleeper didn't get to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:332: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:333: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
@@ -347,7 +348,7 @@
 		if iterations != 0 {
 			t.Fatalf("our sleeper got to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:354: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:355: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
@@ -380,7 +381,7 @@
 func builder(t *testing.T) (string, string) {
 	env := v23tests.New(t)
 	defer env.Cleanup()
-	bin := env.BuildGoPkg("v.io/x/ref/lib/testutil/v23tests")
+	bin := env.BuildGoPkg("v.io/x/ref/test/v23tests")
 	return env.BinDir(), bin.Path()
 }