Merge ""x/ref": Pass CallEnd to CaveatValidators"
diff --git a/cmd/mgmt/mgmt_v23_test.go b/cmd/mgmt/mgmt_v23_test.go
index 172ecdb..7226894 100644
--- a/cmd/mgmt/mgmt_v23_test.go
+++ b/cmd/mgmt/mgmt_v23_test.go
@@ -34,6 +34,7 @@
 	"strings"
 	"time"
 
+	"v.io/v23/security"
 	"v.io/x/ref/lib/testutil/v23tests"
 	_ "v.io/x/ref/profiles"
 )
@@ -352,7 +353,7 @@
 	// also be from some VAR or something.  For now, hardcoded, but this
 	// should be fixed along with
 	// https://github.com/veyron/release-issues/issues/98
-	if got, want := namespaceBin.Run("resolve", n), fmt.Sprintf("[alice/myworkstation]%v", namespaceRoot); got != want {
+	if got, want := namespaceBin.Run("resolve", n), security.JoinPatternName(security.BlessingPattern("alice/myworkstation"), namespaceRoot); got != want {
 		i.Fatalf("got %q, want %q", got, want)
 	}
 
diff --git a/cmd/namespace/impl.go b/cmd/namespace/impl.go
index 8c6615f..b12d76d 100644
--- a/cmd/namespace/impl.go
+++ b/cmd/namespace/impl.go
@@ -2,6 +2,7 @@
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"v.io/v23"
@@ -9,6 +10,7 @@
 	"v.io/v23/ipc"
 	"v.io/v23/naming"
 	"v.io/v23/options"
+	"v.io/v23/security"
 	"v.io/x/lib/cmdline"
 	"v.io/x/lib/vlog"
 )
@@ -52,7 +54,7 @@
 		case *naming.MountEntry:
 			fmt.Fprint(cmd.Stdout(), v.Name)
 			for _, s := range v.Servers {
-				fmt.Fprintf(cmd.Stdout(), " %v%s (Expires %s)", fmtBlessingPatterns(s.BlessingPatterns), s.Server, s.Expires)
+				fmt.Fprintf(cmd.Stdout(), " %s (Expires %s)", security.JoinPatternName(fmtBlessingPatterns(s.BlessingPatterns), s.Server), s.Expires)
 			}
 			fmt.Fprintln(cmd.Stdout())
 		case *naming.GlobError:
@@ -231,14 +233,12 @@
 
 func fmtServer(m *naming.MountEntry, idx int) string {
 	s := m.Servers[idx]
-	return fmt.Sprintf("%v%s", fmtBlessingPatterns(s.BlessingPatterns), naming.JoinAddressName(s.Server, m.Name))
+	return security.JoinPatternName(fmtBlessingPatterns(s.BlessingPatterns),
+		naming.JoinAddressName(s.Server, m.Name))
 }
 
-func fmtBlessingPatterns(p []string) string {
-	if len(p) == 0 {
-		return ""
-	}
-	return fmt.Sprintf("%v", p)
+func fmtBlessingPatterns(p []string) security.BlessingPattern {
+	return security.BlessingPattern(strings.Join(p, ","))
 }
 
 func blessingsOfRunningServer(ctx *context.T, server string) ([]string, error) {
diff --git a/examples/rps/service.vdl b/examples/rps/service.vdl
index 708cb85..9f09af9 100644
--- a/examples/rps/service.vdl
+++ b/examples/rps/service.vdl
@@ -1,4 +1,4 @@
-// Package rps is an example of veyron service for playing the game of
+// Package rps is an example of vanadium service for playing the game of
 // Rock-Paper-Scissors. (http://en.wikipedia.org/wiki/Rock-paper-scissors)
 //
 // There are three different roles in the game:
diff --git a/examples/rps/service.vdl.go b/examples/rps/service.vdl.go
index b3f6829..1cb6535 100644
--- a/examples/rps/service.vdl.go
+++ b/examples/rps/service.vdl.go
@@ -1,7 +1,7 @@
 // This file was auto-generated by the veyron vdl tool.
 // Source: service.vdl
 
-// Package rps is an example of veyron service for playing the game of
+// Package rps is an example of vanadium service for playing the game of
 // Rock-Paper-Scissors. (http://en.wikipedia.org/wiki/Rock-paper-scissors)
 //
 // There are three different roles in the game:
diff --git a/examples/tunnel/vsh/main.go b/examples/tunnel/vsh/main.go
index e37f0df..ef4a0ed 100644
--- a/examples/tunnel/vsh/main.go
+++ b/examples/tunnel/vsh/main.go
@@ -51,15 +51,15 @@
 through the tunneld service. The flag value is localaddr,remoteaddr. E.g.
   -L :14141,www.google.com:80
 
-%s can't be used directly with tools like rsync because veyron object names
+%s can't be used directly with tools like rsync because vanadium object names
 don't look like traditional hostnames, which rsync doesn't understand. For
 compatibility with such tools, %s has a special feature that allows passing the
-veyron object name via the VSH_NAME environment variable.
+vanadium object name via the VSH_NAME environment variable.
 
-  $ VSH_NAME=<object name> rsync -avh -e %s /foo/* veyron:/foo/
+  $ VSH_NAME=<object name> rsync -avh -e %s /foo/* v23:/foo/
 
-In this example, the "veyron" host will be substituted with $VSH_NAME by %s
-and rsync will work as expected.
+In this example, the "v23" host will be substituted with $VSH_NAME by %s and
+rsync will work as expected.
 
 Full flags:
 `, os.Args[0], bname, bname, bname, bname, os.Args[0], bname)
@@ -162,9 +162,9 @@
 	// don't look like traditional hostnames, tools that work with rsh and
 	// ssh can't work directly with vsh. This trick makes the following
 	// possible:
-	//   $ VSH_NAME=<object name> rsync -avh -e vsh /foo/* veyron:/foo/
-	// The "veyron" host will be substituted with <object name>.
-	if envName := os.Getenv("VSH_NAME"); len(envName) > 0 && name == "veyron" {
+	//   $ VSH_NAME=<object name> rsync -avh -e vsh /foo/* v23:/foo/
+	// The "v23" host will be substituted with <object name>.
+	if envName := os.Getenv("VSH_NAME"); len(envName) > 0 && name == "v23" {
 		name = envName
 	}
 	cmd := strings.Join(args, " ")
diff --git a/lib/filelocker/locker.go b/lib/filelocker/locker.go
deleted file mode 100644
index 05b9af8..0000000
--- a/lib/filelocker/locker.go
+++ /dev/null
@@ -1,59 +0,0 @@
-// package filelocker provides a primitive that lets a process
-// lock access to a file.
-package filelocker
-
-import (
-	"os"
-	"syscall"
-
-	"v.io/x/lib/vlog"
-)
-
-// Unlocker is the interface to unlock a locked file.
-type Unlocker interface {
-	// Unlock unlocks the file.
-	Unlock()
-}
-
-// Lock locks the provided file.
-//
-// If the file is already locked then the calling goroutine
-// blocks until the lock can be grabbed.
-//
-// The file must exist otherwise an error is returned.
-func Lock(filepath string) (Unlocker, error) {
-	file, err := os.Open(filepath)
-	if err != nil {
-		return nil, err
-	}
-	if err = syscall.Flock(int(file.Fd()), syscall.LOCK_EX); err != nil {
-		return nil, err
-	}
-	return &unlocker{file}, nil
-}
-
-// TryLock tries to grab a lock on the provided file and
-// returns an error if it fails. This function is non-blocking.
-//
-// The file must exist otherwise an error is returned.
-func TryLock(filepath string) (Unlocker, error) {
-	file, err := os.Open(filepath)
-	if err != nil {
-		return nil, err
-	}
-	if err = syscall.Flock(int(file.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
-		return nil, err
-	}
-	return &unlocker{file}, nil
-}
-
-// unlocker implements Unlocker.
-type unlocker struct {
-	file *os.File
-}
-
-func (u *unlocker) Unlock() {
-	if err := u.file.Close(); err != nil {
-		vlog.Errorf("failed to unlock file %q: %v", u.file.Name(), err)
-	}
-}
diff --git a/lib/filelocker/locker_test.go b/lib/filelocker/locker_test.go
deleted file mode 100644
index b0ea46e..0000000
--- a/lib/filelocker/locker_test.go
+++ /dev/null
@@ -1,160 +0,0 @@
-package filelocker
-
-import (
-	"bufio"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"syscall"
-	"testing"
-	"time"
-
-	"v.io/x/ref/lib/modules"
-	"v.io/x/ref/lib/testutil/expect"
-)
-
-//go:generate v23 test generate
-
-func newFile() string {
-	file, err := ioutil.TempFile("", "test_lock_file")
-	if err != nil {
-		panic(err)
-	}
-	defer file.Close()
-	return file.Name()
-}
-
-func grabbedLock(lock <-chan bool) bool {
-	select {
-	case <-lock:
-		return true
-	case <-time.After(100 * time.Millisecond):
-		return false
-	}
-}
-
-func testLockChild(stdin io.Reader, stdout, stderr io.Writer, env map[string]string, args ...string) error {
-	// Lock the file
-	unlocker, err := Lock(args[0])
-	if err != nil {
-		return fmt.Errorf("Lock failed: %v", err)
-	}
-	fmt.Fprintf(stdout, "locked\n")
-
-	// Wait for message from parent to unlock the file.
-	scanner := bufio.NewScanner(stdin)
-	if scanned := scanner.Scan(); !scanned || (scanned && scanner.Text() != "unlock") {
-		unlocker.Unlock()
-		return fmt.Errorf("unexpected message read from stdout, expected %v", "unlock")
-	}
-	unlocker.Unlock()
-	fmt.Fprintf(stdout, "unlocked\n")
-	return nil
-}
-
-func TestLockInterProcess(t *testing.T) {
-	filepath := newFile()
-	defer os.Remove(filepath)
-
-	sh, err := modules.NewShell(nil, nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %s", err)
-	}
-	defer sh.Cleanup(os.Stderr, os.Stderr)
-	h, err := sh.Start("testLockChild", nil, filepath)
-	if err != nil {
-		t.Fatalf("sh.Start failed: %v", err)
-	}
-	s := expect.NewSession(t, h.Stdout(), time.Minute)
-
-	// Test that child grabbed the lock.
-	s.Expect("locked")
-
-	// Test that parent cannot grab the lock, and then send a message
-	// to the child to release the lock.
-	lock := make(chan bool)
-	go func() {
-		unlocker, err := Lock(filepath)
-		if err != nil {
-			t.Fatalf("Lock failed: %v", err)
-		}
-		close(lock)
-		unlocker.Unlock()
-	}()
-	if grabbedLock(lock) {
-		t.Fatal("Parent process unexpectedly grabbed lock before child released it")
-	}
-
-	// Test that the parent can grab the lock after the child has released it.
-	h.Stdin().Write([]byte("unlock\n"))
-	s.Expect("unlocked")
-	if !grabbedLock(lock) {
-		t.Fatal("Parent process failed to grab the lock after child released it")
-	}
-	s.ExpectEOF()
-}
-
-func TestLockIntraProcess(t *testing.T) {
-	filepath := newFile()
-	defer os.Remove(filepath)
-
-	// Grab the lock within this goroutine and test that
-	// another goroutine blocks when trying to grab the lock.
-	unlocker, err := Lock(filepath)
-	if err != nil {
-		t.Fatalf("Lock failed: %v", err)
-	}
-	lock := make(chan bool)
-	go func() {
-		unlocker, err := Lock(filepath)
-		if err != nil {
-			t.Fatalf("Lock failed: %v", err)
-		}
-		close(lock)
-		unlocker.Unlock()
-	}()
-	if grabbedLock(lock) {
-		unlocker.Unlock()
-		t.Fatal("Another goroutine unexpectedly grabbed lock before this goroutine released it")
-	}
-
-	// Release the lock and test that the goroutine can grab it.
-	unlocker.Unlock()
-	if !grabbedLock(lock) {
-		t.Fatal("Another goroutine failed to grab the lock after this goroutine released it")
-	}
-}
-
-func TestTryLock(t *testing.T) {
-	filepath := newFile()
-	defer os.Remove(filepath)
-
-	sh, err := modules.NewShell(nil, nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %s", err)
-	}
-	defer sh.Cleanup(os.Stderr, os.Stderr)
-	h, err := sh.Start("testLockChild", nil, filepath)
-	if err != nil {
-		t.Fatalf("sh.Start failed: %v", err)
-	}
-	s := expect.NewSession(t, h.Stdout(), time.Minute)
-
-	// Test that child grabbed the lock.
-	s.Expect("locked")
-
-	// Test that parent cannot grab the lock, and then send a message
-	// to the child to release the lock.
-	if _, err := TryLock(filepath); err != syscall.EWOULDBLOCK {
-		t.Fatal("TryLock returned error: %v, want: %v", err, syscall.EWOULDBLOCK)
-	}
-
-	// Test that the parent can grab the lock after the child has released it.
-	h.Stdin().Write([]byte("unlock\n"))
-	s.Expect("unlocked")
-	if _, err = TryLock(filepath); err != nil {
-		t.Fatalf("TryLock failed: %v", err)
-	}
-	s.ExpectEOF()
-}
diff --git a/lib/filelocker/v23_internal_test.go b/lib/filelocker/v23_internal_test.go
deleted file mode 100644
index 65ed9a5..0000000
--- a/lib/filelocker/v23_internal_test.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// This file was auto-generated via go generate.
-// DO NOT UPDATE MANUALLY
-package filelocker
-
-import "fmt"
-import "testing"
-import "os"
-
-import "v.io/x/ref/lib/modules"
-import "v.io/x/ref/lib/testutil"
-
-func init() {
-	modules.RegisterChild("testLockChild", ``, testLockChild)
-}
-
-func TestMain(m *testing.M) {
-	testutil.Init()
-	if modules.IsModulesProcess() {
-		if err := modules.Dispatch(); err != nil {
-			fmt.Fprintf(os.Stderr, "modules.Dispatch failed: %v\n", err)
-			os.Exit(1)
-		}
-		return
-	}
-	os.Exit(m.Run())
-}
diff --git a/lib/testutil/v23tests/v23tests_test.go b/lib/testutil/v23tests/v23tests_test.go
index d64ed11..4937d26 100644
--- a/lib/testutil/v23tests/v23tests_test.go
+++ b/lib/testutil/v23tests/v23tests_test.go
@@ -13,6 +13,7 @@
 	"time"
 
 	"v.io/v23/naming"
+	"v.io/v23/security"
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/modules"
@@ -65,7 +66,7 @@
 		inv := nsBin.Start("glob", "...")
 		parts := re.FindStringSubmatch(inv.ReadLine())
 		if len(parts) == 2 {
-			if got, want := fmt.Sprintf("[root/child]%v", proxyAddress), parts[1]; got != want {
+			if want, got := security.JoinPatternName("root/child", proxyAddress), parts[1]; got != want {
 				t.Fatalf("got: %v, want: %v", got, want)
 			} else {
 				break
@@ -284,7 +285,7 @@
 		msg := recover().(string)
 		// this, and the tests below are intended to ensure that line #s
 		// are captured and reported correctly.
-		if got, want := msg, "v23tests_test.go:294"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:295"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "fork/exec /bin/echox: no such file or directory"; !strings.Contains(got, want) {
@@ -302,7 +303,7 @@
 	_, inv := v23tests.RunRootMT(env, "--xxveyron.tcp.address=127.0.0.1:0")
 	defer func() {
 		msg := recover().(string)
-		if got, want := msg, "v23tests_test.go:312"; !strings.Contains(got, want) {
+		if got, want := msg, "v23tests_test.go:313"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 		if got, want := msg, "exit status 2"; !strings.Contains(got, want) {
@@ -326,7 +327,7 @@
 		if iterations == 0 {
 			t.Fatalf("our sleeper didn't get to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:334: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:335: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
@@ -350,7 +351,7 @@
 		if iterations != 0 {
 			t.Fatalf("our sleeper got to run")
 		}
-		if got, want := recover().(string), "v23tests_test.go:358: timed out"; !strings.Contains(got, want) {
+		if got, want := recover().(string), "v23tests_test.go:359: timed out"; !strings.Contains(got, want) {
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
diff --git a/lib/unit/distance.go b/lib/unit/distance.go
deleted file mode 100644
index 19e6312..0000000
--- a/lib/unit/distance.go
+++ /dev/null
@@ -1,186 +0,0 @@
-package unit
-
-import (
-	"fmt"
-	"math"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-// metersInFoot denotes the number of meters in one foot, which is *exactly*
-// 0.3048 (i.e., there is no rounding).
-const (
-	metersInFoot = 0.3048
-	// MaxDistance represents the largest expressable distance.
-	MaxDistance Distance = math.MaxFloat64
-)
-
-// Distance represents a physical distance with floating-point precision.
-// It can be expressed in both metric and imperial units.
-//
-// Distance is internally stored in millimeter units.
-type Distance float64
-
-// Common distances.  To convert an integer number of units into a Distance,
-// multiply:
-//       fmt.Print(5*unit.Meter) // prints "5m0mm"
-//
-// To count a number of units in a Distance, divide:
-//       d := 5*unit.Meter
-//       fmt.Print(int64(d/unit.Centimeter)) // prints 500
-//
-// Distances can be added or subtracted:
-//       fmt.Print(5*unit.Meter + 3*unit.Centimeter) // prints "5m30mm"
-//       fmt.Print(3*unit.Kilometer - 2*unit.Kilometer) // prints "1km0m0mm"
-const (
-	Millimeter Distance = 1
-	Centimeter          = 10 * Millimeter
-	Meter               = 1000 * Millimeter
-	Kilometer           = 1000 * Meter
-	Foot                = metersInFoot * Meter
-	Inch                = Foot / 12
-	Yard                = 3 * Foot
-	Mile                = 1760 * Yard
-)
-
-var parseRegexp = regexp.MustCompile("^([0-9\\+\\-\\.eE]*)([mM][iI]|[kK][mM]|[mM][mM]|[cC][mM]|[fF][tT]|[iI][nN]|[fF][tT]|[yY][dD]|[mM])")
-
-// Parse parses the provided string and returns a new Distance.  The provided
-// string must be of the following format:
-//
-//         [+-]*(<positive_float_num>("mi"|"km"|"m"|"yd"|"ft"|"in"|"cm"|"mm"))+
-//
-// For example, the following are legitimate distance strings:
-//
-//         "10.2mi8km0.3m12yd100ft18in12.82cm22mm"
-//         "10km12m88cm"
-//         "12yd8ft3in"
-//         "-12yd3.2ft"
-//
-// ParseDistance will return an error if the string doesn't conform to the
-// above format.
-func ParseDistance(value string) (Distance, error) {
-	var total Distance
-	s := value
-
-	// See if the string starts with a +- sign and if so consume it.
-	neg := false
-	if len(s) > 0 && s[0] == '+' {
-		s = s[1:]
-	} else if len(s) > 0 && s[0] == '-' {
-		s = s[1:]
-		neg = true
-	}
-	match := parseRegexp.FindStringSubmatch(s)
-	if match == nil {
-		return 0, fmt.Errorf("invalid distance string: %q", value)
-	}
-	for match != nil && len(match) == 3 {
-		full, value, unit := match[0], match[1], match[2]
-		// Parse value.
-		f, err := strconv.ParseFloat(value, 64)
-		if err != nil {
-			return 0, fmt.Errorf("error parsing float in distance string %q: %s", value, err)
-		}
-		if f < 0 {
-			return 0, fmt.Errorf("can't use negative float unit count in distance string %q: %f", value, f)
-		}
-		// Parse unit.
-		var mult Distance
-		switch strings.ToLower(unit) {
-		case "mi":
-			mult = Mile
-		case "km":
-			mult = Kilometer
-		case "m":
-			mult = Meter
-		case "yd":
-			mult = Yard
-		case "ft":
-			mult = Foot
-		case "in":
-			mult = Inch
-		case "cm":
-			mult = Centimeter
-		case "mm":
-			mult = Millimeter
-		default: // should never happen
-			return 0, fmt.Errorf("illegal unit in distance string %q: %q", value, unit)
-		}
-		// Add the newly parsed sub-distance to the total.
-		total += Distance(f) * mult
-		// Advance to the next matched sub-distance.
-		s = s[len(full):]
-		match = parseRegexp.FindStringSubmatch(s)
-	}
-
-	if len(s) > 0 {
-		return 0, fmt.Errorf("invalid distance string: %q", value)
-	}
-
-	if neg {
-		total *= -1
-	}
-	return total, nil
-}
-
-func (d Distance) String() string {
-	var sign string
-	if d < 0 {
-		sign = "-"
-	}
-	v := math.Abs(float64(d))
-	kms := math.Floor(v / float64(Kilometer))
-	v = v - kms*float64(Kilometer)
-	ms := math.Floor(v / float64(Meter))
-	v = v - ms*float64(Meter)
-	mms := v
-	if kms > 0 {
-		return fmt.Sprintf("%s%gkm%gm%gmm", sign, kms, ms, mms)
-	}
-	if ms > 0 {
-		return fmt.Sprintf("%s%gm%gmm", sign, ms, mms)
-	}
-	return fmt.Sprintf("%s%gmm", sign, mms)
-}
-
-// Miles returns a distance value in mile units.
-func (d Distance) Miles() float64 {
-	return float64(d / Mile)
-}
-
-// Kilometers returns a distance value in kilometer units.
-func (d Distance) Kilometers() float64 {
-	return float64(d / Kilometer)
-}
-
-// Meters returns a distance value in meter units.
-func (d Distance) Meters() float64 {
-	return float64(d / Meter)
-}
-
-// Yards returns a distance value in yard units.
-func (d Distance) Yards() float64 {
-	return float64(d / Yard)
-}
-
-// Feet returns a distance value in foot units.
-func (d Distance) Feet() float64 {
-	return float64(d / Foot)
-}
-
-// Inches returns a distance value in inch units.
-func (d Distance) Inches() float64 {
-	return float64(d / Inch)
-}
-
-// Centimeters returns a distance value in centimeter units.
-func (d Distance) Centimeters() float64 {
-	return float64(d / Centimeter)
-}
-
-// Millimeters returns a distance value in millimeter units.
-func (d Distance) Millimeters() float64 {
-	return float64(d)
-}
diff --git a/lib/unit/distance_test.go b/lib/unit/distance_test.go
deleted file mode 100644
index d0521ea..0000000
--- a/lib/unit/distance_test.go
+++ /dev/null
@@ -1,259 +0,0 @@
-package unit
-
-import (
-	"math"
-	"testing"
-)
-
-func floatEq(first, second float64) bool {
-	const maxPrecisionError = 0.00000001
-	return math.Abs(float64(first)-float64(second)) <= maxPrecisionError
-}
-
-func TestDistanceAccessorsMetric(t *testing.T) {
-	d := 1 * Kilometer
-	if !floatEq(d.Kilometers(), 1) {
-		t.Errorf("kilometers error: have %v, want %v", d.Kilometers(), 1)
-	}
-	if !floatEq(d.Meters(), 1000) {
-		t.Errorf("meters error: have %v, want %v", d.Meters(), 1000)
-	}
-	if !floatEq(d.Centimeters(), 100000) {
-		t.Errorf("centimeters error: have %v, want %v", d.Centimeters(), 100000)
-	}
-	if !floatEq(d.Millimeters(), 1000000) {
-		t.Errorf("millimeters error: have %v, want %v", d.Millimeters(), 1000000)
-	}
-}
-
-func TestDistanceAccessorsImperial(t *testing.T) {
-	d := 1 * Mile
-	if !floatEq(d.Miles(), 1) {
-		t.Errorf("miles error: have %v, want %v", d.Miles(), 1)
-	}
-	if !floatEq(d.Yards(), 1760) {
-		t.Errorf("yards error: have %v, want %v", d.Yards(), float64(5280)/3)
-	}
-	if !floatEq(d.Feet(), 5280) {
-		t.Errorf("feet error: have %v, want %v", d.Feet(), 5280)
-	}
-	if !floatEq(d.Inches(), 63360) {
-		t.Errorf("inches error: have %v, want %v", d.Inches(), 63360)
-	}
-}
-
-func TestDistanceUnitConversions(t *testing.T) {
-	d := 100.9 * Meter
-	if !floatEq(d.Miles(), d.Feet()/5280) {
-		t.Error("wrong miles <-> feet conversion")
-	}
-	if !floatEq(d.Kilometers(), d.Meters()/1000) {
-		t.Error("wrong kilometers <-> meters conversion")
-	}
-	if !floatEq(d.Meters(), d.Centimeters()/100) {
-		t.Error("wrong meters <-> centimeters conversion")
-	}
-	if !floatEq(d.Feet(), d.Meters()/0.3048) {
-		t.Error("wrong feet <-> meters conversion")
-	}
-	if !floatEq(d.Feet(), d.Inches()/12) {
-		t.Error("wrong feet -> inches conversion.")
-	}
-	if !floatEq(d.Centimeters(), d.Millimeters()/10) {
-		t.Error("wrong centimeters -> millimeters conversion")
-	}
-}
-
-func TestDistanceParseAgainstConstants(t *testing.T) {
-	testcases := []struct {
-		string   string
-		expected Distance
-	}{
-		{"1mi", 1 * Mile},
-		{"1km", 1 * Kilometer},
-		{"1m", 1 * Meter},
-		{"1yd", 1 * Yard},
-		{"1ft", 1 * Foot},
-		{"1in", 1 * Inch},
-		{"1cm", 1 * Centimeter},
-		{"1mm", 1 * Millimeter},
-		{"0.1mi", 0.1 * Mile},
-		{"0.1km", 0.1 * Kilometer},
-		{"0.1m", 0.1 * Meter},
-		{"0.1yd", 0.1 * Yard},
-		{"0.1ft", 0.1 * Foot},
-		{"0.1in", 0.1 * Inch},
-		{"0.1cm", 0.1 * Centimeter},
-		{"0.1mm", 0.1 * Millimeter},
-		{"-18.2mi", -18.2 * Mile},
-		{"-18.2km", -18.2 * Kilometer},
-		{"-18.2m", -18.2 * Meter},
-		{"-18.2yd", -18.2 * Yard},
-		{"-18.2ft", -18.2 * Foot},
-		{"-18.2in", -18.2 * Inch},
-		{"-18.2cm", -18.2 * Centimeter},
-		{"-18.2mm", -18.2 * Millimeter},
-		{"10mi9m", 10*Mile + 9*Meter},
-		{"10km9m8cm", 10*Kilometer + 9*Meter + 8*Centimeter},
-		{"10m9m8m", 27 * Meter},
-		{"-1cm100cm20cm2m", -1 * (2*Meter + 121*Centimeter)},
-	}
-	for _, tc := range testcases {
-		d, err := ParseDistance(tc.string)
-		if err != nil {
-			t.Errorf("ParseDistance(%q) returned error: %v", tc.string, err)
-			continue
-		}
-		if !floatEq(d.Millimeters(), tc.expected.Millimeters()) {
-			t.Errorf("ParseDistance(%q).Millimeters() = %v; want %v", tc.string, d.Millimeters(), tc.expected.Millimeters())
-		}
-	}
-}
-
-func TestDistanceParseAgainstParse(t *testing.T) {
-	testcases := []struct {
-		first, second string
-	}{
-		// Singles.
-		{"1mi", "5280ft"},
-		{"1km", "1000m"},
-		{"1m", "100cm"},
-		{"1yd", "3ft"},
-		{"1ft", "12in"},
-		{"1in", "2.54cm"},
-		{"1cm", "10mm"},
-		{"-1cm", "-10mm"},
-		{"10mi", "52800ft"},
-		{"10km", "10000m"},
-		{"10m", "1000cm"},
-		{"10yd", "30ft"},
-		{"10ft", "120in"},
-		{"10in", "25.4cm"},
-		{"10cm", "100mm"},
-		{"-10cm", "-100mm"},
-		{"0.1mi", "528ft"},
-		{"0.1km", "100m"},
-		{"0.1m", "10cm"},
-		{"0.1yd", "0.3ft"},
-		{"0.1ft", "1.2in"},
-		{"0.1in", "0.254cm"},
-		{"0.1cm", "1mm"},
-		{"-0.1cm", "-1mm"},
-		// Pairs.
-		{"1mi1km", "1mi1000m"},
-		{"1mi1m", "1mi100cm"},
-		{"1mi1yd", "1mi3ft"},
-		{"1mi1ft", "5281ft"},
-		{"1mi1in", "5280ft1in"},
-		{"1mi1cm", "5280ft10mm"},
-		{"1mi1mm", "5280ft1mm"},
-		{"-1mi1mm", "-5280ft1mm"},
-		{"1km1m", "1001m"},
-		{"1km1yd", "1000m3ft"},
-		{"1km1ft", "1000m12in"},
-		{"1km1in", "1000m2.54cm"},
-		{"1km1cm", "1000m10mm"},
-		{"1km1mm", "1000m0.1cm"},
-		{"-1km1mm", "-1000m0.1cm"},
-		{"1m1yd", "3ft100cm"},
-		{"1m1ft", "12in100cm"},
-		{"1m1in", "102.54cm"},
-		{"1m1cm", "101cm"},
-		{"1m1mm", "1001mm"},
-		{"-1m1mm", "-1001mm"},
-		{"1yd1ft", "4ft"},
-		{"1yd1in", "3ft1in"},
-		{"1yd1cm", "3ft10mm"},
-		{"1yd1mm", "3ft0.1cm"},
-		{"-1yd1mm", "-3ft0.1cm"},
-		{"1ft1in", "13in"},
-		{"1ft1cm", "12in10mm"},
-		{"1ft1mm", "12in0.1cm"},
-		{"-1ft1mm", "-12in0.1cm"},
-		{"1in1cm", "1in10mm"},
-		{"1in1mm", "1in0.1cm"},
-		{"-1in1mm", "-1in0.1cm"},
-		{"1cm1mm", "11mm"},
-		// Complex.
-		{"1mi1km1m1yd1ft1in1cm1mm", "1001m5284ft1in11mm"},
-		{"-1mi1km1m1yd1ft1in1cm1mm", "-1001m5284ft1in11mm"},
-		// CAPS.
-		{"1Mi", "1mI"},
-		{"1mi", "1MI"},
-		{"1Km", "1kM"},
-		{"1km", "1KM"},
-		{"1M", "1m"},
-		{"1Yd", "1yD"},
-		{"1yd", "1YD"},
-		{"1Ft", "1fT"},
-		{"1ft", "1FT"},
-		{"1In", "1iN"},
-		{"1in", "1IN"},
-		{"1Cm", "1cM"},
-		{"1cm", "1CM"},
-		{"1Mm", "1mM"},
-		{"1mm", "1MM"},
-	}
-	for _, tc := range testcases {
-		first, err := ParseDistance(tc.first)
-		if err != nil {
-			t.Errorf("ParseDistance(%q) returned error: %v", tc.first, err)
-			continue
-		}
-		second, err := ParseDistance(tc.second)
-		if err != nil {
-			t.Errorf("ParseDistance(%q) returned error: err", tc.second, err)
-			continue
-		}
-		if !floatEq(first.Millimeters(), second.Millimeters()) {
-			t.Errorf("ParseDistance(%q).Millimeters() = %v; want %v = ParseDistance(%q).Millimeters()", tc.first, first.Millimeters(), second.Millimeters(), tc.second)
-		}
-	}
-}
-
-func TestDistanceString(t *testing.T) {
-	testcases := []struct {
-		d        Distance
-		expected string
-	}{
-		{1 * Kilometer, "1km0m0mm"},
-		{1 * Meter, "1m0mm"},
-		{1 * Millimeter, "1mm"},
-		{1200 * Meter, "1km200m0mm"},
-		{1.3 * Kilometer, "1km300m0mm"},
-		{-2.7 * Kilometer, "-2km700m0mm"},
-		{5.33 * Millimeter, "5.33mm"},
-		{3.0000000000001 * Millimeter, "3.0000000000001mm"},
-		{9*Kilometer + 12*Meter, "9km12m0mm"},
-		{9*Kilometer - 12*Meter, "8km988m0mm"},
-		{12*Meter - 9*Kilometer, "-8km988m0mm"},
-		{9*Kilometer + 2222*Meter + 1024.5*Millimeter, "11km223m24.5mm"},
-		{-1*Kilometer - 3200.3*Meter - 22*Millimeter, "-4km200m322mm"},
-	}
-	for _, tc := range testcases {
-		if tc.d.String() != tc.expected {
-			t.Errorf("Got string %q; want %q", tc.d, tc.expected)
-		}
-	}
-}
-
-func TestDistanceParseError(t *testing.T) {
-	testcases := []string{
-		"1kf",
-		"1fm",
-		"1kmm",
-		"m",
-		"cm",
-		"1ft 1mi",
-		" 1ft 1mi",
-		"1ft 1mi ",
-		"1ft   1mi",
-		"1mi-4km",
-		"-3km-4m",
-	}
-	for _, ds := range testcases {
-		if d, err := ParseDistance(ds); err == nil {
-			t.Errorf("ParseDistance(%q) = %q; want error", ds, d)
-		}
-	}
-}
diff --git a/lib/unit/doc.go b/lib/unit/doc.go
deleted file mode 100644
index df53801..0000000
--- a/lib/unit/doc.go
+++ /dev/null
@@ -1,2 +0,0 @@
-// Package unit implements types for working with various measurement units.
-package unit
diff --git a/profiles/internal/ipc/client.go b/profiles/internal/ipc/client.go
index 8363bd4..85cd4f7 100644
--- a/profiles/internal/ipc/client.go
+++ b/profiles/internal/ipc/client.go
@@ -28,7 +28,6 @@
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	"v.io/x/ref/profiles/internal/ipc/version"
 	inaming "v.io/x/ref/profiles/internal/naming"
-	ivtrace "v.io/x/ref/profiles/internal/vtrace"
 )
 
 const pkgPath = "v.io/x/ref/profiles/internal/ipc"
@@ -722,7 +721,7 @@
 		GrantedBlessings: fc.grantedBlessings,
 		Blessings:        blessingsRequest,
 		Discharges:       fc.discharges,
-		TraceRequest:     ivtrace.Request(fc.ctx),
+		TraceRequest:     vtrace.GetRequest(fc.ctx),
 	}
 	if err := fc.enc.Encode(req); err != nil {
 		berr := verror.New(verror.ErrBadProtocol, fc.ctx, verror.New(errRequestEncoding, fc.ctx, fmt.Sprintf("%#v", req), err))
@@ -885,7 +884,7 @@
 		clientAckBlessings(fc.flow.VCDataCache(), fc.blessings)
 	}
 	// Incorporate any VTrace info that was returned.
-	ivtrace.Merge(fc.ctx, fc.response.TraceResponse)
+	vtrace.GetStore(fc.ctx).Merge(fc.response.TraceResponse)
 	if fc.response.Error != nil {
 		// TODO(cnicolaou): remove verror.ErrNoAccess with verror version
 		// when ipc.Server is converted.
diff --git a/profiles/internal/ipc/full_test.go b/profiles/internal/ipc/full_test.go
index 7e50888..8adb4bf 100644
--- a/profiles/internal/ipc/full_test.go
+++ b/profiles/internal/ipc/full_test.go
@@ -515,43 +515,43 @@
 		}{
 			// Client accepts talking to the server only if the
 			// server's blessings match the provided pattern
-			{bServer, "[...]mountpoint/server", nil, noErrID, ""},
-			{bServer, "[root/server]mountpoint/server", nil, noErrID, ""},
-			{bServer, "[root/otherserver]mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
-			{bServer, "[otherroot/server]mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
+			{bServer, "__(...)/mountpoint/server", nil, noErrID, ""},
+			{bServer, "__(root/server)/mountpoint/server", nil, noErrID, ""},
+			{bServer, "__(root/otherserver)/mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
+			{bServer, "__(otherroot/server)/mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
 
 			// and, if the server's blessing has third-party
 			// caveats then the server provides appropriate
 			// discharges.
-			{bServerTPValid, "[...]mountpoint/server", nil, noErrID, ""},
-			{bServerTPValid, "[root/serverWithTPCaveats]mountpoint/server", nil, noErrID, ""},
-			{bServerTPValid, "[root/otherserver]mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
-			{bServerTPValid, "[otherroot/server]mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
+			{bServerTPValid, "__(...)/mountpoint/server", nil, noErrID, ""},
+			{bServerTPValid, "__(root/serverWithTPCaveats)/mountpoint/server", nil, noErrID, ""},
+			{bServerTPValid, "__(root/otherserver)/mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
+			{bServerTPValid, "__(otherroot/server)/mountpoint/server", nil, verror.ErrNotTrusted, nameErr},
 
 			// Client does not talk to a server that presents
 			// expired blessings (because the blessing store is
 			// configured to only talk to root).
-			{bServerExpired, "[...]mountpoint/server", nil, verror.ErrNotTrusted, forPeerErr},
+			{bServerExpired, "__(...)/mountpoint/server", nil, verror.ErrNotTrusted, forPeerErr},
 
 			// Client does not talk to a server that fails to
 			// provide discharges for third-party caveats on the
 			// blessings presented by it.
-			{bServerTPExpired, "[...]mountpoint/server", nil, verror.ErrNotTrusted, forPeerErr},
+			{bServerTPExpired, "__(...)/mountpoint/server", nil, verror.ErrNotTrusted, forPeerErr},
 
 			// Testing the AllowedServersPolicy option.
-			{bServer, "[...]mountpoint/server", options.AllowedServersPolicy{"otherroot"}, verror.ErrNotTrusted, allowedErr},
-			{bServer, "[root/server]mountpoint/server", options.AllowedServersPolicy{"otherroot"}, verror.ErrNotTrusted, allowedErr},
-			{bServer, "[otherroot/server]mountpoint/server", options.AllowedServersPolicy{"root/server"}, verror.ErrNotTrusted, nameErr},
-			{bServer, "[root/server]mountpoint/server", options.AllowedServersPolicy{"root"}, noErrID, ""},
+			{bServer, "__(...)/mountpoint/server", options.AllowedServersPolicy{"otherroot"}, verror.ErrNotTrusted, allowedErr},
+			{bServer, "__(root/server)/mountpoint/server", options.AllowedServersPolicy{"otherroot"}, verror.ErrNotTrusted, allowedErr},
+			{bServer, "__(otherroot/server)/mountpoint/server", options.AllowedServersPolicy{"root/server"}, verror.ErrNotTrusted, nameErr},
+			{bServer, "__(root/server)/mountpoint/server", options.AllowedServersPolicy{"root"}, noErrID, ""},
 
 			// Test the ServerPublicKey option.
-			{bServer, "[...]mountpoint/server", options.ServerPublicKey{bServer.PublicKey()}, noErrID, ""},
-			{bServer, "[...]mountpoint/server", options.ServerPublicKey{tsecurity.NewPrincipal("irrelevant").PublicKey()}, verror.ErrNotTrusted, publicKeyErr},
+			{bServer, "__(...)/mountpoint/server", options.ServerPublicKey{bServer.PublicKey()}, noErrID, ""},
+			{bServer, "__(...)/mountpoint/server", options.ServerPublicKey{tsecurity.NewPrincipal("irrelevant").PublicKey()}, verror.ErrNotTrusted, publicKeyErr},
 			// Server presents two blessings: One that satisfies
 			// the pattern provided to StartCall and one that
 			// satisfies the AllowedServersPolicy, so the server is
 			// authorized.
-			{bTwoBlessings, "[root/serverWithTPCaveats]mountpoint/server", options.AllowedServersPolicy{"root/server"}, noErrID, ""},
+			{bTwoBlessings, "__(root/serverWithTPCaveats)/mountpoint/server", options.AllowedServersPolicy{"root/server"}, noErrID, ""},
 		}
 	)
 
diff --git a/profiles/internal/ipc/glob_test.go b/profiles/internal/ipc/glob_test.go
index 4f2ac23..4ea0c1c 100644
--- a/profiles/internal/ipc/glob_test.go
+++ b/profiles/internal/ipc/glob_test.go
@@ -62,7 +62,7 @@
 
 	var (
 		noExist        = verror.New(verror.ErrNoExist, ctx, "")
-		notImplemented = ipc.NewErrGlobNotImplemented(ctx, "")
+		notImplemented = reserved.NewErrGlobNotImplemented(ctx)
 		maxRecursion   = reserved.NewErrGlobMaxRecursionReached(ctx)
 	)
 
@@ -85,7 +85,7 @@
 			"a/x/y",
 			"a/x/y/z",
 			"leaf",
-		}, []naming.GlobError{{Name: "leaf", Error: notImplemented}}},
+		}, nil},
 		{"a", "...", []string{
 			"",
 			"b",
@@ -129,7 +129,7 @@
 			"",
 		}, nil},
 		{"", "", []string{""}, nil},
-		{"", "*", []string{"a", "leaf"}, []naming.GlobError{{Name: "leaf", Error: notImplemented}}},
+		{"", "*", []string{"a", "leaf"}, nil},
 		{"a", "", []string{""}, nil},
 		{"a", "*", []string{"b", "x"}, nil},
 		{"a/b", "", []string{""}, nil},
@@ -149,7 +149,7 @@
 		{"a/b/c1/bad", "", []string{}, []naming.GlobError{{Name: "", Error: noExist}}},
 		{"a/x/bad", "", []string{}, []naming.GlobError{{Name: "", Error: noExist}}},
 		{"a/x/y/bad", "", []string{}, []naming.GlobError{{Name: "", Error: noExist}}},
-		{"leaf", "", []string{""}, []naming.GlobError{{Name: "", Error: notImplemented}}},
+		{"leaf", "", []string{""}, nil},
 		{"leaf", "*", []string{}, []naming.GlobError{{Name: "", Error: notImplemented}}},
 		{"leaf/foo", "", []string{}, []naming.GlobError{{Name: "", Error: noExist}}},
 		// muah is an infinite space to test rescursion limit.
diff --git a/profiles/internal/ipc/reserved.go b/profiles/internal/ipc/reserved.go
index df5d5c6..34579fa 100644
--- a/profiles/internal/ipc/reserved.go
+++ b/profiles/internal/ipc/reserved.go
@@ -203,7 +203,7 @@
 		call.M.MethodTags = []*vdl.Value{vdl.ValueOf(access.Debug)}
 	}
 	if disp == nil {
-		return ipc.NewErrGlobNotImplemented(call.Context(), i.receiver)
+		return reserved.NewErrGlobNotImplemented(call.Context())
 	}
 
 	type gState struct {
@@ -269,10 +269,11 @@
 		if gs == nil || (gs.AllGlobber == nil && gs.ChildrenGlobber == nil) {
 			if state.glob.Len() == 0 {
 				call.Send(naming.VDLGlobReplyEntry{naming.VDLMountEntry{Name: state.name}})
+			} else {
+				call.Send(naming.VDLGlobReplyError{
+					naming.GlobError{Name: state.name, Error: reserved.NewErrGlobNotImplemented(call.Context())},
+				})
 			}
-			call.Send(naming.VDLGlobReplyError{
-				naming.GlobError{Name: state.name, Error: ipc.NewErrGlobNotImplemented(call.Context(), state.name)},
-			})
 			continue
 		}
 		if gs.AllGlobber != nil {
diff --git a/profiles/internal/ipc/server.go b/profiles/internal/ipc/server.go
index eccc3cc..6ee0b8f 100644
--- a/profiles/internal/ipc/server.go
+++ b/profiles/internal/ipc/server.go
@@ -30,7 +30,6 @@
 	"v.io/x/ref/profiles/internal/ipc/stream/vc"
 	"v.io/x/ref/profiles/internal/lib/publisher"
 	inaming "v.io/x/ref/profiles/internal/naming"
-	ivtrace "v.io/x/ref/profiles/internal/vtrace"
 
 	// TODO(cnicolaou): finish verror2 -> verror transition, in particular
 	// for communicating from server to client.
@@ -957,7 +956,7 @@
 
 	var traceResponse vtrace.Response
 	if fs.allowDebug {
-		traceResponse = ivtrace.Response(fs.T)
+		traceResponse = vtrace.GetResponse(fs.T)
 	}
 
 	// Respond to the client with the response header and positional results.
diff --git a/profiles/internal/ipc/stream/vc/vc_test.go b/profiles/internal/ipc/stream/vc/vc_test.go
index eab33fc..9a9ff00 100644
--- a/profiles/internal/ipc/stream/vc/vc_test.go
+++ b/profiles/internal/ipc/stream/vc/vc_test.go
@@ -586,11 +586,12 @@
 
 type endpoint naming.RoutingID
 
-func (e endpoint) Network() string             { return "test" }
-func (e endpoint) VersionedString(int) string  { return e.String() }
-func (e endpoint) String() string              { return naming.RoutingID(e).String() }
-func (e endpoint) Name() string                { return naming.JoinAddressName(e.String(), "") }
-func (e endpoint) RoutingID() naming.RoutingID { return naming.RoutingID(e) }
-func (e endpoint) Addr() net.Addr              { return nil }
-func (e endpoint) ServesMountTable() bool      { return false }
-func (e endpoint) BlessingNames() []string     { return nil }
+func (e endpoint) Network() string                          { return "test" }
+func (e endpoint) VersionedString(int) string               { return e.String() }
+func (e endpoint) String() string                           { return naming.RoutingID(e).String() }
+func (e endpoint) Name() string                             { return naming.JoinAddressName(e.String(), "") }
+func (e endpoint) RoutingID() naming.RoutingID              { return naming.RoutingID(e) }
+func (e endpoint) Addr() net.Addr                           { return nil }
+func (e endpoint) ServesMountTable() bool                   { return false }
+func (e endpoint) BlessingNames() []string                  { return nil }
+func (e endpoint) IPCVersionRange() version.IPCVersionRange { return version.IPCVersionRange{} }
diff --git a/profiles/internal/naming/endpoint.go b/profiles/internal/naming/endpoint.go
index 9e04c2c..684c1fb 100644
--- a/profiles/internal/naming/endpoint.go
+++ b/profiles/internal/naming/endpoint.go
@@ -267,6 +267,11 @@
 	return ep.Blessings
 }
 
+func (ep *Endpoint) IPCVersionRange() version.IPCVersionRange {
+	//nologcall
+	return version.IPCVersionRange{Min: ep.MinIPCVersion, Max: ep.MaxIPCVersion}
+}
+
 type addr struct {
 	network, address string
 }
diff --git a/profiles/internal/naming/namespace/all_test.go b/profiles/internal/naming/namespace/all_test.go
index 867bed3..70b0a95 100644
--- a/profiles/internal/naming/namespace/all_test.go
+++ b/profiles/internal/naming/namespace/all_test.go
@@ -698,8 +698,8 @@
 		t.Errorf("Got %v, wanted a single server", e.Servers)
 	} else if s := e.Servers[0]; s.Server != ep1 || len(s.BlessingPatterns) != 1 || s.BlessingPatterns[0] != "idp/server" {
 		t.Errorf("Got (%q, %v) want (%q, [%q])", s.Server, s.BlessingPatterns, ep1, "idp/server")
-	} else if e, err = resolve("[otherpattern]server"); err != nil {
-		// Resolving with the "[<pattern>]<OA>" syntax, then <pattern> wins.
+	} else if e, err = resolve("__(otherpattern)/server"); err != nil {
+		// Resolving with the "__(<pattern>)/<OA>" syntax, then <pattern> wins.
 		t.Error(err)
 	} else if s = e.Servers[0]; s.Server != ep1 || len(s.BlessingPatterns) != 1 || s.BlessingPatterns[0] != "otherpattern" {
 		t.Errorf("Got (%q, %v) want (%q, [%q])", s.Server, s.BlessingPatterns, ep1, "otherpattern")
diff --git a/profiles/internal/naming/namespace/glob_test.go b/profiles/internal/naming/namespace/glob_test.go
index 7d6ff2c..790b459 100644
--- a/profiles/internal/naming/namespace/glob_test.go
+++ b/profiles/internal/naming/namespace/glob_test.go
@@ -2,8 +2,6 @@
 
 import (
 	"testing"
-
-	"v.io/v23/security"
 )
 
 func TestDepth(t *testing.T) {
@@ -27,44 +25,3 @@
 		}
 	}
 }
-
-func TestSplitObjectName(t *testing.T) {
-	const notset = ""
-	cases := []struct {
-		input      string
-		mt, server security.BlessingPattern
-		name       string
-	}{
-		{"[foo/bar]", notset, "foo/bar", ""},
-		{"[x/y]/", "x/y", notset, "/"},
-		{"[foo]a", notset, "foo", "a"},
-		{"[foo]/a", "foo", notset, "/a"},
-		{"[foo]/a/[bar]", "foo", "bar", "/a"},
-		{"a/b", notset, notset, "a/b"},
-		{"[foo]a/b", notset, "foo", "a/b"},
-		{"/a/b", notset, notset, "/a/b"},
-		{"[foo]/a/b", "foo", notset, "/a/b"},
-		{"/a/[bar]b", notset, "bar", "/a/b"},
-		{"[foo]/a/[bar]b", "foo", "bar", "/a/b"},
-		{"/a/b[foo]", notset, notset, "/a/b[foo]"},
-		{"/a/b/[foo]c", notset, notset, "/a/b/[foo]c"},
-		{"/[01:02::]:444", notset, notset, "/[01:02::]:444"},
-		{"[foo]/[01:02::]:444", "foo", notset, "/[01:02::]:444"},
-		{"/[01:02::]:444/foo", notset, notset, "/[01:02::]:444/foo"},
-		{"[a]/[01:02::]:444/foo", "a", notset, "/[01:02::]:444/foo"},
-		{"/[01:02::]:444/[b]foo", notset, "b", "/[01:02::]:444/foo"},
-		{"[c]/[01:02::]:444/[d]foo", "c", "d", "/[01:02::]:444/foo"},
-	}
-	for _, c := range cases {
-		mt, server, name := splitObjectName(c.input)
-		if mt != c.mt {
-			t.Errorf("%q: unexpected mt pattern: %q not %q", c.input, mt, c.mt)
-		}
-		if server != c.server {
-			t.Errorf("%q: unexpected server pattern: %q not %q", c.input, server, c.server)
-		}
-		if name != c.name {
-			t.Errorf("%q: unexpected name: %q not %q", c.input, name, c.name)
-		}
-	}
-}
diff --git a/profiles/internal/naming/namespace/namespace.go b/profiles/internal/naming/namespace/namespace.go
index a4c081e..acf146d 100644
--- a/profiles/internal/naming/namespace/namespace.go
+++ b/profiles/internal/naming/namespace/namespace.go
@@ -1,7 +1,6 @@
 package namespace
 
 import (
-	"regexp"
 	"sync"
 	"time"
 
@@ -16,8 +15,6 @@
 const defaultMaxResolveDepth = 32
 const defaultMaxRecursiveGlobDepth = 10
 
-var serverPatternRegexp = regexp.MustCompile("^\\[([^\\]]+)\\](.*)")
-
 const pkgPath = "v.io/x/ref/profiles/internal/naming/namespace"
 
 var (
@@ -128,7 +125,7 @@
 //     configured in "ns" will be used).
 func (ns *namespace) rootMountEntry(name string, opts ...naming.ResolveOpt) (*naming.MountEntry, security.BlessingPattern, bool) {
 	name = naming.Clean(name)
-	_, objPattern, name := splitObjectName(name)
+	objPattern, name := security.SplitPatternName(name)
 	mtPattern := getRootPattern(opts)
 	e := new(naming.MountEntry)
 	expiration := time.Now().Add(time.Hour) // plenty of time for a call
@@ -210,40 +207,6 @@
 	return nil
 }
 
-// TODO(ribrdb,ashankar): This is exported only for the mock namespace to share
-// functionality.  Refactor this sharing and do not use this function outside
-// the one place it is being used to implement a mock namespace.
-func InternalSplitObjectName(name string) (p security.BlessingPattern, n string) {
-	_, p, n = splitObjectName(name)
-	return
-}
-
-// TODO(ashankar,ribrdb): Get rid of "mtPattern"?
-func splitObjectName(name string) (mtPattern, serverPattern security.BlessingPattern, objectName string) {
-	objectName = name
-	match := serverPatternRegexp.FindSubmatch([]byte(name))
-	if match != nil {
-		objectName = string(match[2])
-		if naming.Rooted(objectName) {
-			mtPattern = security.BlessingPattern(match[1])
-		} else {
-			serverPattern = security.BlessingPattern(match[1])
-			return
-		}
-	}
-	if !naming.Rooted(objectName) {
-		return
-	}
-
-	address, relative := naming.SplitAddressName(objectName)
-	match = serverPatternRegexp.FindSubmatch([]byte(relative))
-	if match != nil {
-		serverPattern = security.BlessingPattern(match[1])
-		objectName = naming.JoinAddressName(address, string(match[2]))
-	}
-	return
-}
-
 func getRootPattern(opts []naming.ResolveOpt) string {
 	for _, opt := range opts {
 		if pattern, ok := opt.(naming.RootBlessingPatternOpt); ok {
diff --git a/profiles/internal/testing/mocks/naming/namespace.go b/profiles/internal/testing/mocks/naming/namespace.go
index 115c6fe..744a6b1 100644
--- a/profiles/internal/testing/mocks/naming/namespace.go
+++ b/profiles/internal/testing/mocks/naming/namespace.go
@@ -9,6 +9,7 @@
 	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/naming/ns"
+	"v.io/v23/security"
 	"v.io/v23/services/security/access"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
@@ -114,7 +115,7 @@
 
 func (ns *namespace) Resolve(ctx *context.T, name string, opts ...naming.ResolveOpt) (*naming.MountEntry, error) {
 	defer vlog.LogCall()()
-	p, n := vnamespace.InternalSplitObjectName(name)
+	p, n := security.SplitPatternName(name)
 	var blessingpatterns []string
 	if len(p) > 0 {
 		blessingpatterns = []string{string(p)}
diff --git a/profiles/internal/vtrace/store.go b/profiles/internal/vtrace/store.go
index c733ed0..1ac8d3c 100644
--- a/profiles/internal/vtrace/store.go
+++ b/profiles/internal/vtrace/store.go
@@ -6,7 +6,6 @@
 	"sync"
 	"time"
 
-	"v.io/v23/context"
 	"v.io/v23/uniqueid"
 	"v.io/v23/vtrace"
 
@@ -79,7 +78,7 @@
 }
 
 // Merge merges a vtrace.Response into the current store.
-func (s *Store) merge(t vtrace.Response) {
+func (s *Store) Merge(t vtrace.Response) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -273,8 +272,3 @@
 	out.ID = ts.id
 	out.Spans = spans
 }
-
-// Merge merges a vtrace.Response into the current store.
-func Merge(ctx *context.T, t vtrace.Response) {
-	getStore(ctx).merge(t)
-}
diff --git a/profiles/internal/vtrace/vtrace.go b/profiles/internal/vtrace/vtrace.go
index 9aca9d7..c35411b 100644
--- a/profiles/internal/vtrace/vtrace.go
+++ b/profiles/internal/vtrace/vtrace.go
@@ -59,29 +59,6 @@
 	return s.store.flags(s.trace)
 }
 
-// Request generates a vtrace.Request from the active Span.
-func Request(ctx *context.T) vtrace.Request {
-	if span := getSpan(ctx); span != nil {
-		return vtrace.Request{
-			SpanID:  span.id,
-			TraceID: span.trace,
-			Flags:   span.flags(),
-		}
-	}
-	return vtrace.Request{}
-}
-
-// Response captures the vtrace.Response for the active Span.
-func Response(ctx *context.T) vtrace.Response {
-	if span := getSpan(ctx); span != nil {
-		return vtrace.Response{
-			Flags: span.flags(),
-			Trace: *span.store.TraceRecord(span.trace),
-		}
-	}
-	return vtrace.Response{}
-}
-
 type contextKey int
 
 const (
@@ -143,6 +120,29 @@
 	return nil
 }
 
+// Request generates a vtrace.Request from the active Span.
+func (m manager) GetRequest(ctx *context.T) vtrace.Request {
+	if span := getSpan(ctx); span != nil {
+		return vtrace.Request{
+			SpanID:  span.id,
+			TraceID: span.trace,
+			Flags:   span.flags(),
+		}
+	}
+	return vtrace.Request{}
+}
+
+// Response captures the vtrace.Response for the active Span.
+func (m manager) GetResponse(ctx *context.T) vtrace.Response {
+	if span := getSpan(ctx); span != nil {
+		return vtrace.Response{
+			Flags: span.flags(),
+			Trace: *span.store.TraceRecord(span.trace),
+		}
+	}
+	return vtrace.Response{}
+}
+
 // Store returns the current vtrace.Store.
 func (m manager) GetStore(ctx *context.T) vtrace.Store {
 	if store := getStore(ctx); store != nil {
diff --git a/services/identity/oauth/googleoauth.go b/services/identity/oauth/googleoauth.go
index 580dfb0..5feb74e 100644
--- a/services/identity/oauth/googleoauth.go
+++ b/services/identity/oauth/googleoauth.go
@@ -1,9 +1,9 @@
 package oauth
 
 import (
-	"code.google.com/p/goauth2/oauth"
 	"encoding/json"
 	"fmt"
+	"golang.org/x/oauth2"
 	"net/http"
 	"os"
 
@@ -46,15 +46,20 @@
 // tokeninfo API to extract the email address from that token.
 func (g *googleOAuth) ExchangeAuthCodeForEmail(authcode string, url string) (string, error) {
 	config := g.oauthConfig(url)
-	t, err := (&oauth.Transport{Config: config}).Exchange(authcode)
+	t, err := config.Exchange(oauth2.NoContext, authcode)
 	if err != nil {
 		return "", fmt.Errorf("failed to exchange authorization code for token: %v", err)
 	}
+
+	if !t.Valid() {
+		return "", fmt.Errorf("oauth2 token invalid")
+	}
 	// Ideally, would validate the token ourselves without an HTTP roundtrip.
 	// However, for now, as per:
 	// https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken
 	// pay an HTTP round-trip to have Google do this.
-	if t.Extra == nil || len(t.Extra["id_token"]) == 0 {
+	idToken, ok := t.Extra("id_token").(string)
+	if !ok {
 		return "", fmt.Errorf("no GoogleIDToken found in OAuth token")
 	}
 	// The GoogleIDToken is currently validated by sending an HTTP request to
@@ -63,7 +68,7 @@
 	// of traffic.  If either is a concern, the GoogleIDToken can be validated
 	// without an additional HTTP request.
 	// See: https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken
-	tinfo, err := http.Get(g.verifyURL + "id_token=" + t.Extra["id_token"])
+	tinfo, err := http.Get(g.verifyURL + "id_token=" + idToken)
 	if err != nil {
 		return "", fmt.Errorf("failed to talk to GoogleIDToken verifier (%q): %v", g.verifyURL, err)
 	}
@@ -80,7 +85,7 @@
 	if gtoken.Issuer != "accounts.google.com" {
 		return "", fmt.Errorf("invalid issuer: %v", gtoken.Issuer)
 	}
-	if gtoken.Audience != config.ClientId {
+	if gtoken.Audience != config.ClientID {
 		return "", fmt.Errorf("unexpected audience(%v) in GoogleIDToken", gtoken.Audience)
 	}
 	return gtoken.Email, nil
@@ -135,14 +140,16 @@
 	return token.Email, client.Name, nil
 }
 
-func (g *googleOAuth) oauthConfig(redirectUrl string) *oauth.Config {
-	return &oauth.Config{
-		ClientId:     g.clientID,
+func (g *googleOAuth) oauthConfig(redirectUrl string) *oauth2.Config {
+	return &oauth2.Config{
+		ClientID:     g.clientID,
 		ClientSecret: g.clientSecret,
 		RedirectURL:  redirectUrl,
-		Scope:        g.scope,
-		AuthURL:      g.authURL,
-		TokenURL:     g.tokenURL,
+		Scopes:       []string{g.scope},
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  g.authURL,
+			TokenURL: g.tokenURL,
+		},
 	}
 }
 
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index 403337f..4302dec 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -460,13 +460,15 @@
 		t.Fatalf("script changed")
 	}
 
-	// Try issuing an update with a binary that has a different major version number. It should fail
-	resolveExpectNotFound(t, ctx, "v2.5DM") // Ensure a clean slate.
-	*envelope = envelopeFromShell(sh, dmEnv, deviceManagerV10Cmd, application.DeviceManagerTitle, "v2.5DM")
-	updateDeviceExpectError(t, ctx, "v2DM", impl.ErrOperationFailed.ID)
+	if false { // Disabled until we figure out how to make it not take 40 seconds to time out
+		// Try issuing an update with a binary that has a different major version number. It should fail
+		resolveExpectNotFound(t, ctx, "v2.5DM") // Ensure a clean slate.
+		*envelope = envelopeFromShell(sh, dmEnv, deviceManagerV10Cmd, application.DeviceManagerTitle, "v2.5DM")
+		updateDeviceExpectError(t, ctx, "v2DM", impl.ErrOperationFailed.ID)
 
-	if evalLink() != scriptPathV2 {
-		t.Fatalf("script changed")
+		if evalLink() != scriptPathV2 {
+			t.Fatalf("script changed")
+		}
 	}
 
 	// Create a third version of the device manager and issue an update.
diff --git a/services/wsprd/app/app.go b/services/wsprd/app/app.go
index 6caddf9..8270824 100644
--- a/services/wsprd/app/app.go
+++ b/services/wsprd/app/app.go
@@ -194,13 +194,9 @@
 
 func (c *Controller) sendRPCResponse(ctx *context.T, w lib.ClientWriter, span vtrace.Span, results []*vdl.Value) {
 	span.Finish()
-	traceRecord := vtrace.GetStore(ctx).TraceRecord(span.Trace())
-
 	response := VeyronRPCResponse{
-		OutArgs: results,
-		TraceResponse: vtrace.Response{
-			Trace: *traceRecord,
-		},
+		OutArgs:       results,
+		TraceResponse: vtrace.GetResponse(ctx),
 	}
 	encoded, err := lib.VomEncode(response)
 	if err != nil {