diff --git a/cmd/gclogs/doc.go b/cmd/gclogs/doc.go
index eddfe2f..4a7e9a0 100644
--- a/cmd/gclogs/doc.go
+++ b/cmd/gclogs/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-gclogs is a utility that safely deletes old log files.
+Command gclogs safely deletes old log files.
 
 It looks for file names that match the format of files produced by the vlog
 package, and deletes the ones that have not changed in the amount of time
@@ -51,7 +51,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.permissions.file=map[]
    specify an acl file as <name>:<aclfile>
diff --git a/cmd/gclogs/gclogs.go b/cmd/gclogs/gclogs.go
index 1939b25..9160287 100644
--- a/cmd/gclogs/gclogs.go
+++ b/cmd/gclogs/gclogs.go
@@ -27,9 +27,9 @@
 	cmdGCLogs = &cmdline.Command{
 		Run:   garbageCollectLogs,
 		Name:  "gclogs",
-		Short: "gclogs is a utility that safely deletes old log files.",
+		Short: "safely deletes old log files",
 		Long: `
-gclogs is a utility that safely deletes old log files.
+Command gclogs safely deletes old log files.
 
 It looks for file names that match the format of files produced by the vlog
 package, and deletes the ones that have not changed in the amount of time
diff --git a/cmd/mounttable/doc.go b/cmd/mounttable/doc.go
index 51b8ac1..7d653ee 100644
--- a/cmd/mounttable/doc.go
+++ b/cmd/mounttable/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The mounttable tool facilitates interaction with a Vanadium mount table.
+Command mounttable sends commands to Vanadium mounttable services.
 
 Usage:
    mounttable <command>
@@ -38,7 +38,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
diff --git a/cmd/mounttable/impl.go b/cmd/mounttable/impl.go
index c8a2bd2..f0adc71 100644
--- a/cmd/mounttable/impl.go
+++ b/cmd/mounttable/impl.go
@@ -197,9 +197,9 @@
 func root() *cmdline.Command {
 	return &cmdline.Command{
 		Name:  "mounttable",
-		Short: "Tool for interacting with a Vanadium mount table",
+		Short: "sends commands to Vanadium mounttable services",
 		Long: `
-The mounttable tool facilitates interaction with a Vanadium mount table.
+Command mounttable sends commands to Vanadium mounttable services.
 `,
 		Children: []*cmdline.Command{cmdGlob, cmdMount, cmdUnmount, cmdResolveStep},
 	}
diff --git a/cmd/namespace/doc.go b/cmd/namespace/doc.go
index 729d6c4..b4ec7fe 100644
--- a/cmd/namespace/doc.go
+++ b/cmd/namespace/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The namespace tool facilitates interaction with the Vanadium namespace.
+Command namespace resolves and manages names in the Vanadium namespace.
 
 The namespace roots are set from the command line via --v23.namespace.root
 command line option or from environment variables that have a name starting with
@@ -22,6 +22,7 @@
    unmount     Removes a server from the namespace
    resolve     Translates a object name to its object address(es)
    resolvetomt Finds the address of the mounttable that holds an object name
+   permissions Manipulates permissions on an entry in the namespace
    help        Display help for commands or topics
 Run "namespace help [command]" for command usage.
 
@@ -44,7 +45,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
@@ -70,11 +71,15 @@
 Returns all matching entries from the namespace.
 
 Usage:
-   namespace glob <pattern>
+   namespace glob [flags] <pattern>
 
 <pattern> is a glob pattern that is matched against all the names below the
 specified mount name.
 
+The namespace glob flags are:
+ -l=false
+   Long listing format.
+
 Namespace Mount
 
 Adds server <server> to the namespace with name <name>.
@@ -125,6 +130,45 @@
    Insecure mode: May return results from untrusted servers and invoke Resolve
    on untrusted mounttables
 
+Namespace Permissions
+
+Commands to get and set the permissions on a name - controlling the blessing
+names required to resolve the name.
+
+The permissions are provided as an JSON-encoded version of the Permissions type
+defined in v.io/v23/security/access/types.vdl.
+
+Usage:
+   namespace permissions <command>
+
+The namespace permissions commands are:
+   get         Gets permissions on a mount name
+   set         Sets permissions on a mount name
+
+Namespace Permissions Get
+
+Get retrieves the permissions on the usage of a name.
+
+The output is a JSON-encoded Permissions object (defined in
+v.io/v23/security/access/types.vdl).
+
+Usage:
+   namespace permissions get <name>
+
+<name> is a name in the namespace.
+
+Namespace Permissions Set
+
+Set replaces the permissions controlling usage of a mount name.
+
+Usage:
+   namespace permissions set <name> <permissions>
+
+<name> is the name on which permissions are to be set.
+
+<permissions> is the path to a file containing a JSON-encoded Permissions object
+(defined in v.io/v23/security/access/types.vdl), or "-" for STDIN.
+
 Namespace Help
 
 Help with no args displays the usage of the parent command.
diff --git a/cmd/namespace/impl.go b/cmd/namespace/impl.go
index 08483ca..91fca65 100644
--- a/cmd/namespace/impl.go
+++ b/cmd/namespace/impl.go
@@ -5,18 +5,24 @@
 package main
 
 import (
+	"encoding/json"
 	"fmt"
+	"os"
+	"sort"
 	"time"
 
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/options"
+	"v.io/v23/security/access"
+	"v.io/v23/verror"
 	"v.io/x/lib/cmdline"
 	"v.io/x/lib/vlog"
 )
 
 var (
+	flagLongGlob            bool
 	flagInsecureResolve     bool
 	flagInsecureResolveToMT bool
 )
@@ -49,18 +55,47 @@
 		vlog.Infof("ns.Glob(%q) failed: %v", pattern, err)
 		return err
 	}
+	if flagLongGlob {
+		// Show all the information we received.
+		for res := range c {
+			switch v := res.(type) {
+			case *naming.GlobReplyEntry:
+				fmt.Fprint(cmd.Stdout(), v.Value.Name)
+				for _, s := range v.Value.Servers {
+					delta := s.Deadline.Time.Sub(time.Now())
+					fmt.Fprintf(cmd.Stdout(), " %s (Expires in %d sec)", s.Server, int(delta.Seconds()))
+				}
+				fmt.Fprintln(cmd.Stdout())
+			case *naming.GlobReplyError:
+				fmt.Fprintf(cmd.Stderr(), "Error: %s: %v\n", v.Value.Name, v.Value.Error)
+			}
+		}
+		return nil
+	}
+	// Show a sorted list of unique names, and any errors.
+	resultSet := make(map[string]struct{})
+	errors := []*naming.GlobError{}
 	for res := range c {
 		switch v := res.(type) {
-		case *naming.MountEntry:
-			fmt.Fprint(cmd.Stdout(), v.Name)
-			for _, s := range v.Servers {
-				fmt.Fprintf(cmd.Stdout(), " %s (Deadline %s)", s.Server, s.Deadline.Time)
+		case *naming.GlobReplyEntry:
+			if v.Value.Name != "" {
+				resultSet[v.Value.Name] = struct{}{}
 			}
-			fmt.Fprintln(cmd.Stdout())
-		case *naming.GlobError:
-			fmt.Fprintf(cmd.Stderr(), "Error: %s: %v\n", v.Name, v.Error)
+		case *naming.GlobReplyError:
+			errors = append(errors, &v.Value)
 		}
 	}
+	results := []string{}
+	for r := range resultSet {
+		results = append(results, r)
+	}
+	sort.Strings(results)
+	for _, result := range results {
+		fmt.Fprintln(cmd.Stdout(), result)
+	}
+	for _, err := range errors {
+		fmt.Fprintf(cmd.Stderr(), "Error: %s: %v\n", err.Name, err.Error)
+	}
 	return nil
 }
 
@@ -204,20 +239,114 @@
 	return nil
 }
 
+var cmdPermissions = &cmdline.Command{
+	Name:  "permissions",
+	Short: "Manipulates permissions on an entry in the namespace",
+	Long: `
+Commands to get and set the permissions on a name - controlling the blessing
+names required to resolve the name.
+
+The permissions are provided as an JSON-encoded version of the Permissions type
+defined in v.io/v23/security/access/types.vdl.
+`,
+	Children: []*cmdline.Command{cmdPermissionsGet, cmdPermissionsSet},
+}
+
+var cmdPermissionsSet = &cmdline.Command{
+	Run:   runPermissionsSet,
+	Name:  "set",
+	Short: "Sets permissions on a mount name",
+	Long: `
+Set replaces the permissions controlling usage of a mount name.
+`,
+	ArgsName: "<name> <permissions>",
+	ArgsLong: `
+<name> is the name on which permissions are to be set.
+
+<permissions> is the path to a file containing a JSON-encoded Permissions
+object (defined in v.io/v23/security/access/types.vdl), or "-" for STDIN.
+`,
+}
+
+func runPermissionsSet(cmd *cmdline.Command, args []string) error {
+	if expected, got := 2, len(args); expected != got {
+		return cmd.UsageErrorf("set: incorrect number of arguments, expected %d, got %d", expected, got)
+	}
+	name := args[0]
+	var perms access.Permissions
+	file := os.Stdin
+	if args[1] != "-" {
+		var err error
+		if file, err = os.Open(args[1]); err != nil {
+			return err
+		}
+		defer file.Close()
+	}
+	if err := json.NewDecoder(file).Decode(&perms); err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(gctx, time.Minute)
+	defer cancel()
+	ns := v23.GetNamespace(ctx)
+	for {
+		_, etag, err := ns.GetPermissions(ctx, name)
+		if err != nil {
+			return err
+		}
+		if err = ns.SetPermissions(ctx, name, perms, etag); verror.ErrorID(err) == verror.ErrBadVersion.ID {
+			vlog.Infof("SetPermissions(%q, %q) failed: %v, retrying...", name, etag, err)
+			continue
+		}
+		return err
+	}
+}
+
+var cmdPermissionsGet = &cmdline.Command{
+	Run:      runPermissionsGet,
+	Name:     "get",
+	Short:    "Gets permissions on a mount name",
+	ArgsName: "<name>",
+	ArgsLong: `
+<name> is a name in the namespace.
+`,
+	Long: `
+Get retrieves the permissions on the usage of a name.
+
+The output is a JSON-encoded Permissions object (defined in
+v.io/v23/security/access/types.vdl).
+`,
+}
+
+func runPermissionsGet(cmd *cmdline.Command, args []string) error {
+	if expected, got := 1, len(args); expected != got {
+		return cmd.UsageErrorf("get: incorrect number of arguments, expected %d, got %d", expected, got)
+	}
+	name := args[0]
+	ctx, cancel := context.WithTimeout(gctx, time.Minute)
+	defer cancel()
+
+	perms, _, err := v23.GetNamespace(ctx).GetPermissions(ctx, name)
+	if err != nil {
+		return err
+	}
+	return json.NewEncoder(cmd.Stdout()).Encode(perms)
+}
+
 func root() *cmdline.Command {
+	cmdGlob.Flags.BoolVar(&flagLongGlob, "l", false, "Long listing format.")
 	cmdResolve.Flags.BoolVar(&flagInsecureResolve, "insecure", false, "Insecure mode: May return results from untrusted servers and invoke Resolve on untrusted mounttables")
 	cmdResolveToMT.Flags.BoolVar(&flagInsecureResolveToMT, "insecure", false, "Insecure mode: May return results from untrusted servers and invoke Resolve on untrusted mounttables")
 	return &cmdline.Command{
 		Name:  "namespace",
-		Short: "Tool for interacting with the Vanadium namespace",
+		Short: "resolves and manages names in the Vanadium namespace",
 		Long: `
-The namespace tool facilitates interaction with the Vanadium namespace.
+Command namespace resolves and manages names in the Vanadium namespace.
 
 The namespace roots are set from the command line via --v23.namespace.root
 command line option or from environment variables that have a name starting
 with V23_NAMESPACE, e.g.  V23_NAMESPACE, V23_NAMESPACE_2, V23_NAMESPACE_GOOGLE,
 etc.  The command line options override the environment.
 `,
-		Children: []*cmdline.Command{cmdGlob, cmdMount, cmdUnmount, cmdResolve, cmdResolveToMT},
+		Children: []*cmdline.Command{cmdGlob, cmdMount, cmdUnmount, cmdResolve, cmdResolveToMT, cmdPermissions},
 	}
 }
diff --git a/cmd/principal/doc.go b/cmd/principal/doc.go
index 5a534c3..40aea3c 100644
--- a/cmd/principal/doc.go
+++ b/cmd/principal/doc.go
@@ -6,8 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The principal tool helps create and manage blessings and the set of trusted
-roots bound to a principal.
+Command principal creates and manages Vanadium principals and blessings.
 
 All objects are printed using base64-VOM-encoding.
 
@@ -51,7 +50,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.permissions.file=map[]
    specify an acl file as <name>:<aclfile>
@@ -209,7 +208,7 @@
  -remote-arg-file=
    If non-empty, the remote key, remote token, and principal will be written to
    the specified file in a JSON object. This can be provided to 'principal bless
-   --remote-arg-file FILE EXTENSION'.
+   --remote-arg-file FILE EXTENSION'
  -set-default=true
    If true, the blessings received will be set as the default blessing in the
    store
@@ -300,7 +299,7 @@
  -remote-arg-file=
    File containing bless arguments written by 'principal recvblessings
    -remote-arg-file FILE EXTENSION' command. This can be provided to bless in
-   place of --remote-key, --remote-token, and <principal>.
+   place of --remote-key, --remote-token, and <principal>
  -remote-key=
    Public key of the remote principal to bless (obtained from the
    'recvblessings' command run by the remote principal
@@ -384,8 +383,11 @@
    principal get <command>
 
 The principal get commands are:
-   default     Return blessings marked as default
-   forpeer     Return blessings marked for the provided peer
+   default         Return blessings marked as default
+   forpeer         Return blessings marked for the provided peer
+   recognizedroots Return recognized blessings, and their associated public key.
+   peermap         Shows the map from peer pattern to which blessing name to
+                   present.
 
 Principal Get Default
 
@@ -393,7 +395,14 @@
 the environment that this tool is running in.
 
 Usage:
-   principal get default
+   principal get default [flags]
+
+The principal get default flags are:
+ -name=false
+   If true, shows the value of the blessing name to be presented to the peer
+ -rootkey=false
+   If true, shows the value of the root key of the certificate chain to be
+   presented to the peer
 
 Principal Get Forpeer
 
@@ -401,7 +410,7 @@
 specified by the environment that this tool is running in.
 
 Usage:
-   principal get forpeer [<peer_1> ... <peer_k>]
+   principal get forpeer [flags] [<peer_1> ... <peer_k>]
 
 <peer_1> ... <peer_k> are the (human-readable string) blessings bound to the
 peer. The returned blessings are marked with a pattern that is matched by at
@@ -409,6 +418,33 @@
 blessings that are marked for all peers (i.e., blessings set on the store with
 the "..." pattern).
 
+The principal get forpeer flags are:
+ -name=false
+   If true, shows the value of the blessing name to be presented to the peer
+ -rootkey=false
+   If true, shows the value of the root key of the certificate chain to be
+   presented to the peer
+
+Principal Get Recognizedroots
+
+Shows list of blessing names that the principal recognizes, and their associated
+public key. If the principal is operating as a client, contacted servers must
+appear on this list. If the principal is operating as a server, clients must
+present blessings derived from this list.
+
+Usage:
+   principal get recognizedroots
+
+Principal Get Peermap
+
+Shows the map from peer pattern to which blessing name to present. If the
+principal operates as a server, it presents its default blessing to all peers.
+If the principal operates as a client, it presents the map value associated with
+the peer it contacts.
+
+Usage:
+   principal get peermap
+
 Principal Addtoroots
 
 Adds an identity provider to the set of recognized roots public keys for this
diff --git a/cmd/principal/main.go b/cmd/principal/main.go
index a5b2305..d706292 100644
--- a/cmd/principal/main.go
+++ b/cmd/principal/main.go
@@ -65,6 +65,10 @@
 	flagRecvBlessingsSetDefault bool
 	flagRecvBlessingsForPeer    string
 
+	// Flags for the commands the get blessings
+	flagBlessingsName    bool
+	flagBlessingsRootKey bool
+
 	errNoCaveats = fmt.Errorf("no caveats provided: it is generally dangerous to bless another principal without any caveats as that gives them almost unrestricted access to the blesser's credentials. If you really want to do this, set --require-caveats=false")
 	cmdDump      = &cmdline.Command{
 		Name:  "dump",
@@ -275,6 +279,40 @@
 		},
 	}
 
+	cmdGetTrustedRoots = &cmdline.Command{
+		Name:  "recognizedroots",
+		Short: "Return recognized blessings, and their associated public key.",
+		Long: `
+Shows list of blessing names that the principal recognizes, and their associated
+public key. If the principal is operating as a client, contacted servers must
+appear on this list. If the principal is operating as a server, clients must
+present blessings derived from this list.
+`,
+		Run: func(cmd *cmdline.Command, args []string) error {
+			ctx, shutdown := v23.Init()
+			defer shutdown()
+			fmt.Printf(v23.GetPrincipal(ctx).Roots().DebugString())
+			return nil
+		},
+	}
+
+	cmdGetPeerMap = &cmdline.Command{
+		Name:  "peermap",
+		Short: "Shows the map from peer pattern to which blessing name to present.",
+		Long: `
+Shows the map from peer pattern to which blessing name to present.
+If the principal operates as a server, it presents its default blessing to all peers.
+If the principal operates as a client, it presents the map value associated with
+the peer it contacts.
+`,
+		Run: func(cmd *cmdline.Command, args []string) error {
+			ctx, shutdown := v23.Init()
+			defer shutdown()
+			fmt.Printf(v23.GetPrincipal(ctx).BlessingStore().DebugString())
+			return nil
+		},
+	}
+
 	cmdGetForPeer = &cmdline.Command{
 		Name:  "forpeer",
 		Short: "Return blessings marked for the provided peer",
@@ -294,8 +332,7 @@
 		Run: func(cmd *cmdline.Command, args []string) error {
 			ctx, shutdown := v23.Init()
 			defer shutdown()
-			principal := v23.GetPrincipal(ctx)
-			return dumpBlessings(principal.BlessingStore().ForPeer(args...))
+			return printBlessingsInfo(v23.GetPrincipal(ctx).BlessingStore().ForPeer(args...))
 		},
 	}
 
@@ -309,8 +346,7 @@
 		Run: func(cmd *cmdline.Command, args []string) error {
 			ctx, shutdown := v23.Init()
 			defer shutdown()
-			principal := v23.GetPrincipal(ctx)
-			return dumpBlessings(principal.BlessingStore().Default())
+			return printBlessingsInfo(v23.GetPrincipal(ctx).BlessingStore().Default())
 		},
 	}
 
@@ -815,7 +851,7 @@
 	cmdBless.Flags.StringVar(&flagBlessWith, "with", "", "Path to file containing blessing to extend")
 	cmdBless.Flags.StringVar(&flagBlessRemoteKey, "remote-key", "", "Public key of the remote principal to bless (obtained from the 'recvblessings' command run by the remote principal")
 	cmdBless.Flags.StringVar(&flagBlessRemoteToken, "remote-token", "", "Token provided by principal running the 'recvblessings' command")
-	cmdBless.Flags.StringVar(&flagRemoteArgFile, "remote-arg-file", "", "File containing bless arguments written by 'principal recvblessings -remote-arg-file FILE EXTENSION' command. This can be provided to bless in place of --remote-key, --remote-token, and <principal>.")
+	cmdBless.Flags.StringVar(&flagRemoteArgFile, "remote-arg-file", "", "File containing bless arguments written by 'principal recvblessings -remote-arg-file FILE EXTENSION' command. This can be provided to bless in place of --remote-key, --remote-token, and <principal>")
 
 	cmdSeekBlessings.Flags.StringVar(&flagSeekBlessingsFrom, "from", "https://dev.v.io/auth/google", "URL to use to begin the seek blessings process")
 	cmdSeekBlessings.Flags.BoolVar(&flagSeekBlessingsSetDefault, "set-default", true, "If true, the blessings obtained will be set as the default blessing in the store")
@@ -831,7 +867,13 @@
 
 	cmdRecvBlessings.Flags.BoolVar(&flagRecvBlessingsSetDefault, "set-default", true, "If true, the blessings received will be set as the default blessing in the store")
 	cmdRecvBlessings.Flags.StringVar(&flagRecvBlessingsForPeer, "for-peer", string(security.AllPrincipals), "If non-empty, the blessings received will be marked for peers matching this pattern in the store")
-	cmdRecvBlessings.Flags.StringVar(&flagRemoteArgFile, "remote-arg-file", "", "If non-empty, the remote key, remote token, and principal will be written to the specified file in a JSON object. This can be provided to 'principal bless --remote-arg-file FILE EXTENSION'.")
+	cmdRecvBlessings.Flags.StringVar(&flagRemoteArgFile, "remote-arg-file", "", "If non-empty, the remote key, remote token, and principal will be written to the specified file in a JSON object. This can be provided to 'principal bless --remote-arg-file FILE EXTENSION'")
+
+	cmdGetForPeer.Flags.BoolVar(&flagBlessingsName, "name", false, "If true, shows the value of the blessing name to be presented to the peer")
+	cmdGetForPeer.Flags.BoolVar(&flagBlessingsRootKey, "rootkey", false, "If true, shows the value of the root key of the certificate chain to be presented to the peer")
+
+	cmdGetDefault.Flags.BoolVar(&flagBlessingsName, "name", false, "If true, shows the value of the blessing name to be presented to the peer")
+	cmdGetDefault.Flags.BoolVar(&flagBlessingsRootKey, "rootkey", false, "If true, shows the value of the root key of the certificate chain to be presented to the peer")
 
 	cmdSet := &cmdline.Command{
 		Name:  "set",
@@ -853,15 +895,14 @@
 
 All blessings are printed to stdout using base64-VOM-encoding.
 `,
-		Children: []*cmdline.Command{cmdGetDefault, cmdGetForPeer},
+		Children: []*cmdline.Command{cmdGetDefault, cmdGetForPeer, cmdGetTrustedRoots, cmdGetPeerMap},
 	}
 
 	root := &cmdline.Command{
 		Name:  "principal",
-		Short: "Create and manage vanadium principals",
+		Short: "creates and manages Vanadium principals and blessings",
 		Long: `
-The principal tool helps create and manage blessings and the set of trusted
-roots bound to a principal.
+Command principal creates and manages Vanadium principals and blessings.
 
 All objects are printed using base64-VOM-encoding.
 `,
@@ -888,6 +929,24 @@
 	return nil
 }
 
+func printBlessingsInfo(blessings security.Blessings) error {
+	if blessings.IsZero() {
+		return fmt.Errorf("no blessings found")
+	}
+	if flagBlessingsName {
+		fmt.Println(blessings)
+		return nil
+	} else if flagBlessingsRootKey {
+		wire, err := blessings2wire(blessings)
+		if err != nil {
+			return err
+		}
+		fmt.Println(rootkey(wire.CertificateChains[0]))
+		return nil
+	}
+	return dumpBlessings(blessings)
+}
+
 func read(fname string) (string, error) {
 	if len(fname) == 0 {
 		return "", nil
diff --git a/cmd/principal/principal_v23_test.go b/cmd/principal/principal_v23_test.go
index 952bec0..1f3cef1 100644
--- a/cmd/principal/principal_v23_test.go
+++ b/cmd/principal/principal_v23_test.go
@@ -116,12 +116,51 @@
 	got := removePublicKeys(bin.WithEnv(blessEnv).Start("dump").Output())
 	want := `Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
 ---------------- BlessingStore ----------------
-Default blessings: alice
-Peer pattern                   : Blessings
-...                            : alice
+Default Blessings                alice
+Peer pattern                     Blessings
+...                              alice
 ---------------- BlessingRoots ----------------
-Public key                                      : Pattern
-XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [alice]
+Public key                                        Pattern
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX   [alice]
+`
+	if want != got {
+		t.Fatalf("unexpected output, got\n%s, wanted\n%s", got, want)
+	}
+}
+
+func V23TestGetRecognizedRoots(t *v23tests.T) {
+	var (
+		outputDir = t.NewTempDir()
+		bin       = t.BuildGoPkg("v.io/x/ref/cmd/principal")
+		aliceDir  = filepath.Join(outputDir, "alice")
+	)
+
+	bin.Start("create", aliceDir, "alice").WaitOrDie(os.Stdout, os.Stderr)
+
+	blessEnv := credEnv(aliceDir)
+	got := removePublicKeys(bin.WithEnv(blessEnv).Start("get", "recognizedroots").Output())
+	want := `Public key                                        Pattern
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX   [alice]
+`
+	if want != got {
+		t.Fatalf("unexpected output, got\n%s, wanted\n%s", got, want)
+	}
+}
+
+func V23TestGetPeermap(t *v23tests.T) {
+	var (
+		outputDir = t.NewTempDir()
+		bin       = t.BuildGoPkg("v.io/x/ref/cmd/principal")
+		aliceDir  = filepath.Join(outputDir, "alice")
+	)
+
+	bin.Start("create", aliceDir, "alice").WaitOrDie(os.Stdout, os.Stderr)
+
+	blessEnv := credEnv(aliceDir)
+	got := removePublicKeys(bin.WithEnv(blessEnv).Start("get", "peermap").Output())
+	want := `Default Blessings                alice
+Peer pattern                     Blessings
+...                              alice
 `
 	if want != got {
 		t.Fatalf("unexpected output, got\n%s, wanted\n%s", got, want)
@@ -225,16 +264,16 @@
 	got := removePublicKeys(bin.Start("--v23.credentials="+carolDir, "dump").Output())
 	want := `Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
 ---------------- BlessingStore ----------------
-Default blessings: alice/friend/carol
-Peer pattern                   : Blessings
-...                            : alice/friend/carol
-alice                          : alice/friend/carol/foralice
-bob                            : bob/friend/carol/forbob
+Default Blessings                alice/friend/carol
+Peer pattern                     Blessings
+...                              alice/friend/carol
+alice                            alice/friend/carol/foralice
+bob                              bob/friend/carol/forbob
 ---------------- BlessingRoots ----------------
-Public key                                      : Pattern
-XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [alice]
-XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [bob]
-XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [carol]
+Public key                                        Pattern
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX   [alice]
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX   [bob]
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX   [carol]
 `
 	if want != got {
 		t.Fatalf("unexpected output, got\n%s, wanted\n%s", got, want)
@@ -263,12 +302,12 @@
 		got := removePublicKeys(bin.Start("--v23.credentials="+alicePhoneDir, "dump").Output())
 		want := `Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
 ---------------- BlessingStore ----------------
-Default blessings: alice/phone
-Peer pattern                   : Blessings
-...                            : alice/phone
+Default Blessings                alice/phone
+Peer pattern                     Blessings
+...                              alice/phone
 ---------------- BlessingRoots ----------------
-Public key                                      : Pattern
-XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [alice]
+Public key                                        Pattern
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX   [alice]
 `
 		if want != got {
 			t.Fatalf("unexpected output, got\n%s, wanted\n%s", got, want)
@@ -298,12 +337,12 @@
 		got := removePublicKeys(bin.Start("--v23.credentials="+alicePhoneCalendarDir, "dump").Output())
 		want := `Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
 ---------------- BlessingStore ----------------
-Default blessings: alice/phone/calendar
-Peer pattern                   : Blessings
-...                            : alice/phone/calendar
+Default Blessings                alice/phone/calendar
+Peer pattern                     Blessings
+...                              alice/phone/calendar
 ---------------- BlessingRoots ----------------
-Public key                                      : Pattern
-XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [alice]
+Public key                                        Pattern
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX   [alice]
 `
 		if want != got {
 			t.Fatalf("unexpected output, got\n%s, wanted\n%s", got, want)
@@ -507,24 +546,16 @@
 	// Have bob create a "bob/friend" blessing and have alice recognize that.
 	redirect(t, bin.Start("--v23.credentials="+bobDir, "bless", "--require-caveats=false", aliceDir, "friend"), blessingFile)
 	bin.Start("--v23.credentials="+aliceDir, "addtoroots", blessingFile).WaitOrDie(os.Stdout, os.Stderr)
-	var (
-		// blessing roots lines that should match the keys
-		aliceLine = fmt.Sprintf("%v : [alice]", publicKey(aliceDir))
-		bobLine   = fmt.Sprintf("%v : [bob]", publicKey(bobDir))
 
-		foundAlice, foundBob bool
-	)
-	// Finally dump alice's principal, it should have lines corresponding to aliceLine and bobLine.
-	output := bin.Start("--v23.credentials="+aliceDir, "dump").Output()
-	for _, line := range strings.Split(output, "\n") {
-		if line == aliceLine {
-			foundAlice = true
-		} else if line == bobLine {
-			foundBob = true
-		}
-	}
-	if !foundAlice || !foundBob {
-		t.Fatalf("Got:\n%v\n\nExpected Blessing Roots to include:\n%s\n%s", output, aliceLine, bobLine)
+	want := fmt.Sprintf(`Public key                                        Pattern
+%v   [alice]
+%v   [bob]
+`, publicKey(aliceDir), publicKey(bobDir))
+
+	// Finally view alice's recognized roots, it should have lines corresponding to aliceLine and bobLine.
+	got := bin.Start("--v23.credentials="+aliceDir, "get", "recognizedroots").Output()
+	if got != want {
+		t.Fatalf("Got:\n%v\n\nWant:\n%v", got, want)
 	}
 }
 
@@ -545,7 +576,7 @@
 	bin.Start("--v23.credentials="+aliceDir, "addtoroots", "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9iRjaFDoGJI9tarUwWqIW31ti72krThkYByn1v9Lf89D9VA0Mg2oUL7FDDM7qxjZcVM1ktM_W4tBfMVuRZmVCA==", "some_other_provider").WaitOrDie(os.Stdout, os.Stderr)
 	// "foo" should appear in the set of BlessingRoots
 	output := bin.Start("--v23.credentials="+aliceDir, "dump").Output()
-	want := fmt.Sprintf("41:26:f6:aa:54:f9:31:d4:9d:1f:d2:69:c6:c5:50:70 : [some_other_provider]")
+	want := fmt.Sprintf("41:26:f6:aa:54:f9:31:d4:9d:1f:d2:69:c6:c5:50:70   [some_other_provider]")
 	for _, line := range strings.Split(output, "\n") {
 		if line == want {
 			return
diff --git a/cmd/principal/v23_test.go b/cmd/principal/v23_test.go
index c0d9525..dddc89a 100644
--- a/cmd/principal/v23_test.go
+++ b/cmd/principal/v23_test.go
@@ -32,6 +32,14 @@
 	v23tests.RunTest(t, V23TestDump)
 }
 
+func TestV23GetRecognizedRoots(t *testing.T) {
+	v23tests.RunTest(t, V23TestGetRecognizedRoots)
+}
+
+func TestV23GetPeermap(t *testing.T) {
+	v23tests.RunTest(t, V23TestGetPeermap)
+}
+
 func TestV23RecvBlessings(t *testing.T) {
 	v23tests.RunTest(t, V23TestRecvBlessings)
 }
diff --git a/cmd/servicerunner/main.go b/cmd/servicerunner/main.go
index fb6abaa..fa54314 100644
--- a/cmd/servicerunner/main.go
+++ b/cmd/servicerunner/main.go
@@ -2,8 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// This binary starts several services (mount table, proxy, wspr), then prints a
-// JSON map with their vars to stdout (as a single line), then waits forever.
+// Command servicerunner runs several Vanadium services, including the
+// mounttable, proxy and wspr.  It prints a JSON map with their vars to stdout
+// (as a single line), then waits forever.
 package main
 
 import (
diff --git a/cmd/uniqueid/doc.go b/cmd/uniqueid/doc.go
index 1b6e4df..485ad1a 100644
--- a/cmd/uniqueid/doc.go
+++ b/cmd/uniqueid/doc.go
@@ -6,8 +6,8 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The uniqueid tool generates unique ids. It also has an option of automatically
-substituting unique ids with placeholders in files.
+Command uniqueid generates unique identifiers. It also has an option of
+automatically substituting unique ids with placeholders in files.
 
 Usage:
    uniqueid <command>
@@ -37,7 +37,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.permissions.file=map[]
    specify an acl file as <name>:<aclfile>
diff --git a/cmd/uniqueid/main.go b/cmd/uniqueid/main.go
index e072764..ca89740 100644
--- a/cmd/uniqueid/main.go
+++ b/cmd/uniqueid/main.go
@@ -34,9 +34,9 @@
 
 var cmdUniqueId = &cmdline.Command{
 	Name:  "uniqueid",
-	Short: "Generates UniqueIds.",
+	Short: "generates unique identifiers",
 	Long: `
-The uniqueid tool generates unique ids.
+Command uniqueid generates unique identifiers.
 It also has an option of automatically substituting unique ids with placeholders in files.
 `,
 	Children: []*cmdline.Command{cmdGenerate, cmdInject},
diff --git a/cmd/vdl/doc.go b/cmd/vdl/doc.go
index 2b34150..7d12ec5 100644
--- a/cmd/vdl/doc.go
+++ b/cmd/vdl/doc.go
@@ -6,8 +6,8 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The vdl tool manages vanadium VDL source code.  It's similar to the go tool used
-for managing Go source code.
+Command vdl manages Vanadium Definition Language source code.  It's similar to
+the go tool used for managing Go source code.
 
 Usage:
    vdl [flags] <command>
diff --git a/cmd/vdl/main.go b/cmd/vdl/main.go
index fb695a3..3f57f9c 100644
--- a/cmd/vdl/main.go
+++ b/cmd/vdl/main.go
@@ -355,10 +355,10 @@
 // Root returns the root command for the VDL tool.
 var cmdVDL = &cmdline.Command{
 	Name:  "vdl",
-	Short: "Manage vanadium VDL source code",
+	Short: "manages Vanadium Definition Language source code",
 	Long: `
-The vdl tool manages vanadium VDL source code.  It's similar to the go tool used
-for managing Go source code.
+Command vdl manages Vanadium Definition Language source code.  It's similar to
+the go tool used for managing Go source code.
 `,
 	Children: []*cmdline.Command{cmdGenerate, cmdCompile, cmdAudit, cmdList},
 	Topics:   []cmdline.Topic{topicPackages, topicVdlPath, topicVdlRoot, topicVdlConfig},
diff --git a/cmd/vom/doc.go b/cmd/vom/doc.go
index 7c24a80..ca40374 100644
--- a/cmd/vom/doc.go
+++ b/cmd/vom/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The vom tool helps debug the Vanadium Object Marshaling (vom) protocol.
+Command vom helps debug the Vanadium Object Marshaling wire protocol.
 
 Usage:
    vom <command>
@@ -36,7 +36,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.permissions.file=map[]
    specify an acl file as <name>:<aclfile>
diff --git a/cmd/vom/vom.go b/cmd/vom/vom.go
index 7a99a60..16b5847 100644
--- a/cmd/vom/vom.go
+++ b/cmd/vom/vom.go
@@ -38,9 +38,9 @@
 
 var cmdVom = &cmdline.Command{
 	Name:  "vom",
-	Short: "Vanadium Object Marshaling debugging tool",
+	Short: "helps debug the Vanadium Object Marshaling wire protocol",
 	Long: `
-The vom tool helps debug the Vanadium Object Marshaling (vom) protocol.
+Command vom helps debug the Vanadium Object Marshaling wire protocol.
 `,
 	Children: []*cmdline.Command{cmdDecode, cmdDump},
 }
diff --git a/cmd/vomtestgen/doc.go b/cmd/vomtestgen/doc.go
index 67e37b3..656f9ff 100644
--- a/cmd/vomtestgen/doc.go
+++ b/cmd/vomtestgen/doc.go
@@ -6,8 +6,10 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The vomtestgen tool generates vom test data, using the vomdata file as input,
-and creating a vdl file as output.
+Command vomtestgen generates test data for the vom wire protocol implementation.
+It takes as input a vdl config file, and outputs a vdl package with test cases.
+Test data is generated using this tool to make it easy to add many test cases,
+and verify them in implementations in different languages
 
 Usage:
    vomtestgen [flags] [vomdata]
@@ -50,7 +52,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.permissions.file=map[]
    specify an acl file as <name>:<aclfile>
diff --git a/cmd/vomtestgen/generate.go b/cmd/vomtestgen/generate.go
index 1a2bd50..cb53110 100644
--- a/cmd/vomtestgen/generate.go
+++ b/cmd/vomtestgen/generate.go
@@ -33,10 +33,12 @@
 var cmdGenerate = &cmdline.Command{
 	Run:   runGenerate,
 	Name:  "vomtestgen",
-	Short: "Generate test data for the vom encoder / decoder",
+	Short: "generates test data for the vom wire protocol implementation",
 	Long: `
-The vomtestgen tool generates vom test data, using the vomdata file as input,
-and creating a vdl file as output.
+Command vomtestgen generates test data for the vom wire protocol implementation.
+It takes as input a vdl config file, and outputs a vdl package with test cases.
+Test data is generated using this tool to make it easy to add many test cases,
+and verify them in implementations in different languages
 `,
 	ArgsName: "[vomdata]",
 	ArgsLong: `
diff --git a/cmd/vrpc/doc.go b/cmd/vrpc/doc.go
index caf236a..f281770 100644
--- a/cmd/vrpc/doc.go
+++ b/cmd/vrpc/doc.go
@@ -6,8 +6,8 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The vrpc tool provides command-line access to Vanadium servers via Remote
-Procedure Call.
+Command vrpc sends and receives Vanadium remote procedure calls.  It is used as
+a generic client to interact with any Vanadium server.
 
 Usage:
    vrpc <command>
@@ -38,7 +38,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
diff --git a/cmd/vrpc/vrpc.go b/cmd/vrpc/vrpc.go
index a00f86e..bde1970 100644
--- a/cmd/vrpc/vrpc.go
+++ b/cmd/vrpc/vrpc.go
@@ -54,10 +54,10 @@
 
 var cmdVRPC = &cmdline.Command{
 	Name:  "vrpc",
-	Short: "Vanadium Remote Procedure Call tool",
+	Short: "sends and receives Vanadium remote procedure calls",
 	Long: `
-The vrpc tool provides command-line access to Vanadium servers via Remote
-Procedure Call.
+Command vrpc sends and receives Vanadium remote procedure calls.  It is used as
+a generic client to interact with any Vanadium server.
 `,
 	// TODO(toddw): Add cmdServe, which will take an interface as input, and set
 	// up a server capable of handling the given methods.  When a request is
diff --git a/cmd/vrun/doc.go b/cmd/vrun/doc.go
index 29d609a..aebe0ba 100644
--- a/cmd/vrun/doc.go
+++ b/cmd/vrun/doc.go
@@ -2,8 +2,11 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// This file was auto-generated via go generate.
+// DO NOT UPDATE MANUALLY
+
 /*
-The vrun tool executes a command with a derived principal.
+Command vrun executes commands with a derived Vanadium principal.
 
 Usage:
    vrun [flags] <command> [command args...]
@@ -13,6 +16,10 @@
    Duration for the blessing.
  -name=
    Name to use for the blessing. Uses the command name if unset.
+ -role=
+   Role object from which to request the blessing. If set, the blessings from
+   this role server are used and --name is ignored. If not set, the default
+   blessings of the calling principal are extended with --name.
 
 The global flags are:
  -alsologtostderr=true
@@ -29,15 +36,27 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
- -veyron.credentials=
+ -v23.credentials=
    directory to use for storing security credentials
- -veyron.namespace.root=[/ns.dev.v.io:8101]
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
- -veyron.vtrace.cache_size=1024
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
    The number of vtrace traces to store in memory.
- -veyron.vtrace.dump_on_shutdown=false
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
    If true, dump all stored traces on runtime shutdown.
- -veyron.vtrace.sample_rate=0
+ -v23.vtrace.sample-rate=0
    Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
diff --git a/cmd/vrun/vrun.go b/cmd/vrun/vrun.go
index a61e720..81c3976 100644
--- a/cmd/vrun/vrun.go
+++ b/cmd/vrun/vrun.go
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// The following enables go generate to generate the doc.go file.
+//go:generate go run $V23_ROOT/release/go/src/v.io/x/lib/cmdline/testdata/gendoc.go . -help
+
 package main
 
 import (
@@ -33,8 +36,8 @@
 var cmdVrun = &cmdline.Command{
 	Run:      vrun,
 	Name:     "vrun",
-	Short:    "Executes a command with a derived principal.",
-	Long:     "The vrun tool executes a command with a derived principal.",
+	Short:    "executes commands with a derived Vanadium principal",
+	Long:     "Command vrun executes commands with a derived Vanadium principal.",
 	ArgsName: "<command> [command args...]",
 }
 
diff --git a/envvar/envvar.go b/envvar/envvar.go
index 6a755a7..e91a566 100644
--- a/envvar/envvar.go
+++ b/envvar/envvar.go
@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package envvar defines accessors for the environment variables used by the reference v23 implementation.
+// Package envvar defines the environment variables used by the reference v23
+// implementation.
 package envvar
 
 import (
diff --git a/examples/rps/internal/common.go b/examples/rps/internal/common.go
index d6a875c..ce75223 100644
--- a/examples/rps/internal/common.go
+++ b/examples/rps/internal/common.go
@@ -75,10 +75,10 @@
 	var servers []string
 	for e := range c {
 		switch v := e.(type) {
-		case *naming.GlobError:
-			vlog.VI(1).Infof("findAll(%q) error for %q: %v", t, v.Name, v.Error)
-		case *naming.MountEntry:
-			servers = append(servers, v.Name)
+		case *naming.GlobReplyError:
+			vlog.VI(1).Infof("findAll(%q) error for %q: %v", t, v.Value.Name, v.Value.Error)
+		case *naming.GlobReplyEntry:
+			servers = append(servers, v.Value.Name)
 		}
 	}
 	vlog.VI(1).Infof("findAll(%q) elapsed: %s", t, time.Now().Sub(start))
diff --git a/examples/rps/rpsbot/main.go b/examples/rps/rpsbot/main.go
index 8a0fa15..492be26 100644
--- a/examples/rps/rpsbot/main.go
+++ b/examples/rps/rpsbot/main.go
@@ -2,12 +2,10 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Command rpsbot is a binary that runs the fully automated
-// implementation of the RockPaperScissors service, which includes all
-// three roles involved in the game of rock-paper-scissors. It
-// publishes itself as player, judge, and scorekeeper. Then, it
-// initiates games with other players, in a loop. As soon as one game
-// is over, it starts a new one.
+// Command rpsbot repeatedly runs automated games, implementing all three roles.
+// It publishes itself as player, judge, and scorekeeper. Then, it initiates
+// games with other players, in a loop. As soon as one game is over, it starts a
+// new one.
 package main
 
 import (
diff --git a/examples/rps/rpsplayer/main.go b/examples/rps/rpsplayer/main.go
index 56122fb..9f84800 100644
--- a/examples/rps/rpsplayer/main.go
+++ b/examples/rps/rpsplayer/main.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Command rpsplayer is a command-line implementation of the Player
-// service that allows a human player to join the game.
+// Command rpsplayer implements the Player interface, which enables a human to
+// play the game.
 package main
 
 import (
@@ -295,11 +295,11 @@
 	}
 	for e := range c {
 		switch v := e.(type) {
-		case *naming.GlobError:
+		case *naming.GlobReplyError:
 			fmt.Print("E")
-		case *naming.MountEntry:
+		case *naming.GlobReplyEntry:
 			fmt.Print(".")
-			result = append(result, v.Name)
+			result = append(result, v.Value.Name)
 		}
 	}
 	if len(result) == 0 {
diff --git a/examples/rps/rpsscorekeeper/main.go b/examples/rps/rpsscorekeeper/main.go
index 329782d..a5611e5 100644
--- a/examples/rps/rpsscorekeeper/main.go
+++ b/examples/rps/rpsscorekeeper/main.go
@@ -2,10 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Command rpsscorekeeper is a simple implementation of the
-// ScoreKeeper service. It publishes itself as a score keeper for the
-// rock-paper-scissors game and prints out all the score cards it
-// receives to stdout.
+// Command rpsscorekeeper implements the ScoreKeeper interface.  It publishes
+// itself as a score keeper for the rock-paper-scissors game and prints out all
+// the score cards it receives to stdout.
 package main
 
 import (
diff --git a/examples/rps/service.vdl b/examples/rps/service.vdl
index f9afda2..b5f9c7c 100644
--- a/examples/rps/service.vdl
+++ b/examples/rps/service.vdl
@@ -2,20 +2,22 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package rps is an example of vanadium service for playing the game of
-// Rock-Paper-Scissors. (http://en.wikipedia.org/wiki/Rock-paper-scissors)
+// Package rps defines interfaces for playing the game Rock-Paper-Scissors.  It
+// is an example of a simple Vanadium service.
+//
+// http://en.wikipedia.org/wiki/Rock-paper-scissors
 //
 // There are three different roles in the game:
 //
-// 1. Judge: A judge enforces the rules of the game and decides who
-//    the winner is. At the end of the game, the judge reports the
-//    final score to all the score keepers.
+// 1. Judge: A judge enforces the rules of the game and decides who the winner
+// is. At the end of the game, the judge reports the final score to all the
+// score keepers.
 //
-// 2. Player: A player can ask a judge to start a new game, it can
-//    challenge another player, and it can play a game.
+// 2. Player: A player can ask a judge to start a new game, it can challenge
+// another player, and it can play a game.
 //
-// 3. ScoreKeeper: A score keeper receives the final score for a game
-//    after it ended.
+// 3. ScoreKeeper: A score keeper receives the final score for a game after it
+// ended.
 package rps
 
 import (
diff --git a/examples/rps/service.vdl.go b/examples/rps/service.vdl.go
index efa4a4d..7ee0216 100644
--- a/examples/rps/service.vdl.go
+++ b/examples/rps/service.vdl.go
@@ -5,20 +5,22 @@
 // This file was auto-generated by the vanadium vdl tool.
 // Source: service.vdl
 
-// Package rps is an example of vanadium service for playing the game of
-// Rock-Paper-Scissors. (http://en.wikipedia.org/wiki/Rock-paper-scissors)
+// Package rps defines interfaces for playing the game Rock-Paper-Scissors.  It
+// is an example of a simple Vanadium service.
+//
+// http://en.wikipedia.org/wiki/Rock-paper-scissors
 //
 // There are three different roles in the game:
 //
-// 1. Judge: A judge enforces the rules of the game and decides who
-//    the winner is. At the end of the game, the judge reports the
-//    final score to all the score keepers.
+// 1. Judge: A judge enforces the rules of the game and decides who the winner
+// is. At the end of the game, the judge reports the final score to all the
+// score keepers.
 //
-// 2. Player: A player can ask a judge to start a new game, it can
-//    challenge another player, and it can play a game.
+// 2. Player: A player can ask a judge to start a new game, it can challenge
+// another player, and it can play a game.
 //
-// 3. ScoreKeeper: A score keeper receives the final score for a game
-//    after it ended.
+// 3. ScoreKeeper: A score keeper receives the final score for a game after it
+// ended.
 package rps
 
 import (
diff --git a/examples/tunnel/tunnel.vdl b/examples/tunnel/tunnel.vdl
index 24629ba..f1bafcb 100644
--- a/examples/tunnel/tunnel.vdl
+++ b/examples/tunnel/tunnel.vdl
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package tunnel describes a service that can be used to create a
-// network tunnel from the client to the server.
+// Package tunnel defines an interface for creating a network tunnel from client
+// to server.
 package tunnel
 
 import "v.io/v23/security/access"
diff --git a/examples/tunnel/tunnel.vdl.go b/examples/tunnel/tunnel.vdl.go
index 6fcca58..7f8cca3 100644
--- a/examples/tunnel/tunnel.vdl.go
+++ b/examples/tunnel/tunnel.vdl.go
@@ -5,8 +5,8 @@
 // This file was auto-generated by the vanadium vdl tool.
 // Source: tunnel.vdl
 
-// Package tunnel describes a service that can be used to create a
-// network tunnel from the client to the server.
+// Package tunnel defines an interface for creating a network tunnel from client
+// to server.
 package tunnel
 
 import (
diff --git a/examples/tunnel/tunneld/main.go b/examples/tunnel/tunneld/main.go
index 55edc16..f9de51e 100644
--- a/examples/tunnel/tunneld/main.go
+++ b/examples/tunnel/tunneld/main.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Command tunneld is an implementation of the tunnel service.
+// Daemon tunneld implements the Tunnel interface.
 package main
 
 import (
diff --git a/examples/tunnel/vsh/main.go b/examples/tunnel/vsh/main.go
index a08c0c3..c038fc5 100644
--- a/examples/tunnel/vsh/main.go
+++ b/examples/tunnel/vsh/main.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Command vsh is a tunnel service client that can be used to start a
-// shell on the server.
+// Command vsh is a Tunnel client that can be used to start a shell on the
+// server.
 package main
 
 import (
diff --git a/lib/exec/doc.go b/lib/exec/doc.go
index a490799..b1b464f 100644
--- a/lib/exec/doc.go
+++ b/lib/exec/doc.go
@@ -2,18 +2,17 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package exec implements process creation and rendezvous, including
-// sharing a secret with, and passing arbitrary configuration to, the newly
-// created process via an anoymous pipe. An anonymous pipe is used since
-// it is the most secure communication channel available.
+// Package exec implements configuration and secret-sharing between parent and
+// child processes via anoymous pipes.  Anonymous pipes are used since they are
+// the most secure communication channel available.
 //
-// Once a parent starts a child process it can use WaitForReady to wait
-// for the child to reach its 'Ready' state. Operations are provided to wait
-// for the child to terminate, and to terminate the child, cleaning up any state
+// Once a parent starts a child process it can use WaitForReady to wait for the
+// child to reach its 'Ready' state.  Operations are provided to wait for the
+// child to terminate, and to terminate the child, cleaning up any state
 // associated with it.
 //
 // A child process uses the GetChildHandle function to complete the initial
-// authentication handshake. The child must call SetReady to indicate that it is
-// fully initialized and ready for whatever purpose it is intended to fulfill.
-// This handshake is referred as the 'exec protocol'.
+// authentication handshake.  The child must call SetReady to indicate that it
+// is fully initialized and ready for whatever purpose it is intended to
+// fulfill.  This handshake is referred as the 'exec protocol'.
 package exec
diff --git a/lib/flags/doc.go b/lib/flags/doc.go
index 5af2a64..6d7807a 100644
--- a/lib/flags/doc.go
+++ b/lib/flags/doc.go
@@ -2,17 +2,17 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package flags provides definitions for commonly used flags and, where
-// appropriate, implementations of the flag.Value interface for those flags to
-// ensure that only valid values of those flags are supplied. Some of these
-// flags may also be specified using environment variables directly and are
-// documented accordingly; in these cases the command line value takes
-// precedence over the environment variable.
+// Package flags implements utilities to augment the standard Go flag package.
+// It defines commonly used Vanadium flags, and implementations of the
+// flag.Value interface for those flags to ensure that only valid values of
+// those flags are supplied.  Some of these flags may also be specified using
+// environment variables directly and are documented accordingly; in these cases
+// the command line value takes precedence over the environment variable.
 //
 // Flags are defined as 'groups' of related flags so that the caller may choose
-// which ones to use without having to be burdened with the full set. The groups
-// may be used directly or via the Flags type that aggregates multiple
-// groups. In all cases, the flags are registered with a supplied flag.FlagSet
+// which ones to use without having to be burdened with the full set.  The
+// groups may be used directly or via the Flags type that aggregates multiple
+// groups.  In all cases, the flags are registered with a supplied flag.FlagSet
 // and hence are not forced onto the command line unless the caller passes in
 // flag.CommandLine as the flag.FlagSet to use.
 //
diff --git a/lib/flags/flags.go b/lib/flags/flags.go
index 20b0b3b..660b727 100644
--- a/lib/flags/flags.go
+++ b/lib/flags/flags.go
@@ -52,7 +52,7 @@
 )
 
 var (
-	defaultNamespaceRoot = "/ns.dev.v.io:8101" // GUARDED_BY namespaceMu
+	defaultNamespaceRoot = "/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101" // GUARDED_BY namespaceMu
 	namespaceMu          sync.Mutex
 
 	defaultProtocol = "wsh" // GUARDED_BY listenMu
@@ -316,6 +316,13 @@
 	namespaceMu.Unlock()
 }
 
+// DefaultNamespaceRoot gets the default value of --v23.namespace.root
+func DefaultNamespaceRoot() string {
+	namespaceMu.Lock()
+	defer namespaceMu.Unlock()
+	return defaultNamespaceRoot
+}
+
 // createAndRegisterListenFlags creates and registers the ListenFlags
 // group with the supplied flag.FlagSet.
 func createAndRegisterListenFlags(fs *flag.FlagSet) *ListenFlags {
diff --git a/lib/flags/flags_test.go b/lib/flags/flags_test.go
index d254996..8909346 100644
--- a/lib/flags/flags_test.go
+++ b/lib/flags/flags_test.go
@@ -206,7 +206,7 @@
 		t.Fatalf("unexpected error: %s", err)
 	}
 	rtf := fl.RuntimeFlags()
-	if got, want := rtf.NamespaceRoots, []string{"/ns.dev.v.io:8101"}; !reflect.DeepEqual(got, want) {
+	if got, want := rtf.NamespaceRoots, []string{"/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101"}; !reflect.DeepEqual(got, want) {
 		t.Errorf("got %q, want %q", got, want)
 	}
 	aclf := fl.AccessListFlags()
@@ -346,7 +346,8 @@
 }
 
 func TestRefreshDefaults(t *testing.T) {
-	defer flags.SetDefaultNamespaceRoot("/ns.dev.v.io:8101")
+	orig := flags.DefaultNamespaceRoot()
+	defer flags.SetDefaultNamespaceRoot(orig)
 	defer flags.SetDefaultHostPort(":0")
 	defer flags.SetDefaultProtocol("wsh")
 
@@ -378,7 +379,8 @@
 }
 
 func TestRefreshAlreadySetDefaults(t *testing.T) {
-	defer flags.SetDefaultNamespaceRoot("/ns.dev.v.io:8101")
+	orig := flags.DefaultNamespaceRoot()
+	defer flags.SetDefaultNamespaceRoot(orig)
 	defer flags.SetDefaultHostPort(":0")
 	defer flags.SetDefaultProtocol("wsh")
 
diff --git a/lib/glob/glob.go b/lib/glob/glob.go
index 7a9e35d..b490715 100644
--- a/lib/glob/glob.go
+++ b/lib/glob/glob.go
@@ -2,24 +2,23 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// glob implements a glob language.
+// Package glob defines a globbing syntax and implements matching routines.
 //
 // Globs match a slash separated series of glob expressions.
 //
-// pattern:
-// term ['/' term]*
-// term:
-// '*'         matches any sequence of non-Separator characters
-// '?'         matches any single non-Separator character
-// '[' [ '^' ] { character-range } ']'
-// character class (must be non-empty)
-// c           matches character c (c != '*', '?', '\\', '[', '/')
-// '\\' c      matches character c
-// character-range:
-// c           matches character c (c != '\\', '-', ']')
-// '\\' c      matches character c
-// lo '-' hi   matches character c for lo <= c <= hi
-
+//   // Patterns:
+//   term ['/' term]*
+//   term:
+//   '*'         matches any sequence of non-Separator characters
+//   '?'         matches any single non-Separator character
+//   '[' [ '^' ] { character-range } ']'
+//   // Character classes (must be non-empty):
+//   c           matches character c (c != '*', '?', '\\', '[', '/')
+//   '\\' c      matches character c
+//   // Character-ranges:
+//   c           matches character c (c != '\\', '-', ']')
+//   '\\' c      matches character c
+//   lo '-' hi   matches character c for lo <= c <= hi
 package glob
 
 import (
diff --git a/lib/security/audit/auditor.go b/lib/security/audit/auditor.go
index dbfbba8..c73c9c7 100644
--- a/lib/security/audit/auditor.go
+++ b/lib/security/audit/auditor.go
@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package audit provides mechanisms to write method invocations to an audit log.
+// Package audit implements a mechanism for writing auditable events to an audit
+// log.
 //
-// Typical use would be for tracking sensitive operations like private key usage (NewPrincipal),
-// or sensitive RPC method invocations.
+// Typical use would be for tracking sensitive operations like private key usage
+// (NewPrincipal), or sensitive RPC method invocations.
 package audit
 
 import (
diff --git a/lib/security/blessingroots.go b/lib/security/blessingroots.go
index 009df29..6ecd0ba 100644
--- a/lib/security/blessingroots.go
+++ b/lib/security/blessingroots.go
@@ -74,12 +74,12 @@
 // DebugString encodes all roots into a string in the following
 // format
 //
-// Public key   : Pattern
-// <public key> : <patterns>
+// Public key     Pattern
+// <public key>   <patterns>
 // ...
-// <public key> : <patterns>
+// <public key>   <patterns>
 func (br *blessingRoots) DebugString() string {
-	const format = "%-47s : %s\n"
+	const format = "%-47s   %s\n"
 	b := bytes.NewBufferString(fmt.Sprintf(format, "Public key", "Pattern"))
 	var s rootSorter
 	for keyBytes, patterns := range br.store {
diff --git a/lib/security/blessingstore.go b/lib/security/blessingstore.go
index bebf3ef..381ec87 100644
--- a/lib/security/blessingstore.go
+++ b/lib/security/blessingstore.go
@@ -150,15 +150,14 @@
 
 // DebugString return a human-readable string encoding of the store
 // in the following format
-// Default blessing : <Default blessing of the store>
-//
-// Peer pattern : Blessings
-// <pattern>    : <blessings>
+// Default Blessings <blessings>
+// Peer pattern   Blessings
+// <pattern>      <blessings>
 // ...
-// <pattern>    : <blessings>
+// <pattern>      <blessings>
 func (bs *blessingStore) DebugString() string {
-	const format = "%-30s : %s\n"
-	b := bytes.NewBufferString(fmt.Sprintf("Default blessings: %v\n", bs.state.Default.Blessings()))
+	const format = "%-30s   %s\n"
+	b := bytes.NewBufferString(fmt.Sprintf(format, "Default Blessings", bs.state.Default.Blessings()))
 
 	b.WriteString(fmt.Sprintf(format, "Peer pattern", "Blessings"))
 
diff --git a/lib/security/doc.go b/lib/security/doc.go
index ea00908..11c7325 100644
--- a/lib/security/doc.go
+++ b/lib/security/doc.go
@@ -2,5 +2,6 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package security provides utility functions for creating/using vanadium security primitives.
+// Package security implements utilities for creating and using Vanadium
+// security primitives.
 package security
diff --git a/lib/security/securityflag/flag.go b/lib/security/securityflag/flag.go
index 48ee109..c2f6acb 100644
--- a/lib/security/securityflag/flag.go
+++ b/lib/security/securityflag/flag.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package securityflag defines a method for parsing AccessList flags and
-// constructing a security.Authorizer based on them.
+// Package securityflag implements utilities for creating security objects based
+// on flags.
 package securityflag
 
 import (
diff --git a/lib/security/serialization/serialization.go b/lib/security/serialization/serialization.go
index b696ad1..f2df90d 100644
--- a/lib/security/serialization/serialization.go
+++ b/lib/security/serialization/serialization.go
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package serialization defines a general-purpose io.WriteCloser
-// for writing data along with an appropriate signature that
-// establishes integrity and authenticity of data, and an io.Reader
-// for reading the data after verifying the signature.
+// Package serialization implements utilities for reading and writing data with
+// signature-based integrity checking.
 package serialization
diff --git a/lib/signals/signals.go b/lib/signals/signals.go
index 1727dc4..bc645d4 100644
--- a/lib/signals/signals.go
+++ b/lib/signals/signals.go
@@ -2,8 +2,13 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package signals implements utilities for managing process shutdown with
+// support for signal-handling.
 package signals
 
+// TODO(caprita): Rename the function to Shutdown() and the package to shutdown
+// since it's not just signals anymore.
+
 import (
 	"os"
 	"os/signal"
@@ -49,9 +54,6 @@
 	return []os.Signal{syscall.SIGTERM, syscall.SIGINT, STOP}
 }
 
-// TODO(caprita): Rename this to Shutdown() and the package to shutdown since
-// it's not just signals anymore.
-
 // ShutdownOnSignals registers signal handlers for the specified signals, or, if
 // none are specified, the default signals.  The first signal received will be
 // made available on the returned channel; upon receiving a second signal, the
diff --git a/lib/stats/histogram/histogram.go b/lib/stats/histogram/histogram.go
index c9b329b..285fabc 100644
--- a/lib/stats/histogram/histogram.go
+++ b/lib/stats/histogram/histogram.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// package histogram implements a basic histogram to keep track of data
+// Package histogram implements a basic histogram to keep track of data
 // distribution.
 package histogram
 
diff --git a/lib/timekeeper/timekeeper.go b/lib/timekeeper/timekeeper.go
index 88c4c42..2fee233 100644
--- a/lib/timekeeper/timekeeper.go
+++ b/lib/timekeeper/timekeeper.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package timekeeper defines an interface to allow switching between real time
+// and simulated time.
 package timekeeper
 
 import "time"
diff --git a/lib/vdl/build/build.go b/lib/vdl/build/build.go
index 07947bb..397ac63 100644
--- a/lib/vdl/build/build.go
+++ b/lib/vdl/build/build.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package build provides utilities to collect VDL build information, and
-// helpers to kick off the parser and compiler.
+// Package build implements utilities to collect VDL build information and run
+// the parser and compiler.
 //
 // VDL Packages
 //
diff --git a/lib/vdl/codegen/doc.go b/lib/vdl/codegen/doc.go
deleted file mode 100644
index 5a8537e..0000000
--- a/lib/vdl/codegen/doc.go
+++ /dev/null
@@ -1,7 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package codegen implements utilities useful for all vdl code generators.
-// Code generators for specific languages live in sub-directories.
-package codegen
diff --git a/lib/vdl/codegen/import.go b/lib/vdl/codegen/import.go
index b25d734..fbe5d23 100644
--- a/lib/vdl/codegen/import.go
+++ b/lib/vdl/codegen/import.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package codegen implements utilities for VDL code generators.  Code
+// generators for specific languages live in sub-directories.
 package codegen
 
 import (
diff --git a/lib/vdl/codegen/java/file_array.go b/lib/vdl/codegen/java/file_array.go
index 4812cd1..e0ef7ab 100644
--- a/lib/vdl/codegen/java/file_array.go
+++ b/lib/vdl/codegen/java/file_array.go
@@ -23,11 +23,10 @@
  * type {{.Name}} {{.VdlTypeString}} {{.Doc}}
  **/
 @io.v.v23.vdl.GeneratedFromVdl(name = "{{.VdlTypeName}}")
+@io.v.v23.vdl.ArrayLength({{.Length}})
 {{ .AccessModifier }} final class {{.Name}} extends io.v.v23.vdl.VdlArray<{{.ElemType}}> {
     private static final long serialVersionUID = 1L;
 
-    public static final int LENGTH = {{.Length}};
-
     public static final io.v.v23.vdl.VdlType VDL_TYPE =
             io.v.v23.vdl.Types.getVdlTypeFromReflect({{.Name}}.class);
 
diff --git a/lib/vdl/compile/compile.go b/lib/vdl/compile/compile.go
index feab45f..dd8cb1d 100644
--- a/lib/vdl/compile/compile.go
+++ b/lib/vdl/compile/compile.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package compile provides utilities to compile vdl files.  The Compile
-// function is the main entry point.
+// Package compile implements the VDL compiler, converting a parse tree into
+// compiled results.  The CompilePackage function is the main entry point.
 package compile
 
 // The job of the compiler is to take parse results as input, and output
diff --git a/lib/vdl/opconst/const.go b/lib/vdl/opconst/const.go
index fa5e04c..f9d0859 100644
--- a/lib/vdl/opconst/const.go
+++ b/lib/vdl/opconst/const.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package opconst provides the representation and operations for vdl constants.
+// Package opconst defines the representation and operations for VDL constants.
 package opconst
 
 import (
diff --git a/lib/vdl/parse/parse.go b/lib/vdl/parse/parse.go
index ab74c83..c4f8394 100644
--- a/lib/vdl/parse/parse.go
+++ b/lib/vdl/parse/parse.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package parse provides utilities to parse vdl files into a parse tree.  The
-// Parse function is the main entry point.
+// Package parse implements the VDL parser, converting source files into a parse
+// tree.  The ParseFile function is the main entry point.
 package parse
 
 //go:generate ./grammar_gen.sh
diff --git a/lib/vdl/vdlutil/doc.go b/lib/vdl/vdlutil/doc.go
deleted file mode 100644
index 509458b..0000000
--- a/lib/vdl/vdlutil/doc.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package vdlutil provides core utilities for vdl files.  It's used by the
-// auto-generated Go code, as well as the vdl parser, compiler and code
-// generators; it should have a small set of dependencies.
-package vdlutil
diff --git a/lib/vdl/vdlutil/util.go b/lib/vdl/vdlutil/util.go
index ba68205..1145857 100644
--- a/lib/vdl/vdlutil/util.go
+++ b/lib/vdl/vdlutil/util.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package vdlutil implements utilities used by many VDL components.  It should
+// have a small set of dependencies.
 package vdlutil
 
 import (
diff --git a/profiles/chrome/chromeinit.go b/profiles/chrome/chromeinit.go
index 5223f6f..6445080 100644
--- a/profiles/chrome/chromeinit.go
+++ b/profiles/chrome/chromeinit.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package chrome implements a profile for use within Chrome, in particular
-// for use by Chrome extensions.
+// Package chrome implements a profile for use within Chrome, in particular for
+// use by Chrome extensions.
 package chrome
 
 import (
diff --git a/profiles/doc.go b/profiles/doc.go
index 7a7cdcd..327c5b9 100644
--- a/profiles/doc.go
+++ b/profiles/doc.go
@@ -2,21 +2,16 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package Profiles, and its children, provide implementations of the
-// v23.Profile function. These implementations should import all of the
-// packages that they require to implement Profile-specific functionality.
+// Package profiles and its subdirectories provide implementations of the
+// Vanadium runtime for different runtime environments.  Each subdirectory is a
+// package that implements the v23.Profile function.
 //
-// The taxonomy used to organise Profiles may be arbitrary and the directory
-// structure used here is just one convention for how to do so. This directory
-// structure reflects the generality of a Profile at any given depth in the
-// hierarchy, with higher levels of the directory structure being more
-// generic and lower levels more specific.
-//
-// Profiles register themselves by calling v.io/v23/rt.RegisterProfile in their
-// init function and are hence are chosen by importing them into an
-// applications main package. It is an error to import more than one profile,
-// and the registration mechanism will panic if this is attempted.
-// Commonly used functionality and pre-canned profiles are in profiles/internal.
+// Profiles register themselves by calling v.io/v23/rt.RegisterProfile in an
+// init function.  Users choose a particular profile implementation by importing
+// the appropriate package in their main package.  It is an error to import more
+// than one profile, and the registration mechanism will panic if this is
+// attempted.  Commonly used functionality and pre-canned profiles are in
+// profiles/internal.
 //
 // This top level directory contains a 'generic' Profile and utility routines
 // used by other Profiles. It should be imported whenever possible and
@@ -26,5 +21,4 @@
 // configurations and in particular dhcp. It should be used by any application
 // that may 'roam' or any may be behind a 1-1 NAT. The 'static' profile
 // does not provide dhcp support, but is otherwise like the roaming profile.
-//
 package profiles
diff --git a/profiles/fake/fake.go b/profiles/fake/fake.go
index bae6df8..ddd6a0d 100644
--- a/profiles/fake/fake.go
+++ b/profiles/fake/fake.go
@@ -2,8 +2,12 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package fake implements a fake profile, useful in tests for mocking out
+// certain components.
 package fake
 
+// TODO(mattr): Make a more complete, but still fake, implementation.
+
 import (
 	"sync"
 
diff --git a/profiles/fake/runtime.go b/profiles/fake/runtime.go
index e2c5cf3..d239b3a 100644
--- a/profiles/fake/runtime.go
+++ b/profiles/fake/runtime.go
@@ -2,9 +2,6 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// fake implements a fake runtime.  The fake runtime is useful in tests when you
-// want to mock out important components.
-// TODO(mattr): Make a more complete, but still fake, implementation.
 package fake
 
 import (
diff --git a/profiles/gce/init.go b/profiles/gce/init.go
index e192b72..15c96d3 100644
--- a/profiles/gce/init.go
+++ b/profiles/gce/init.go
@@ -4,8 +4,8 @@
 
 // +build linux
 
-// Package gce provides a profile for Google Compute Engine and should be
-// used by binaries that only ever expect to be run on GCE.
+// Package gce implements a profile for binaries that only run on Google Compute
+// Engine.
 package gce
 
 import (
diff --git a/profiles/internal/naming/namespace/all_test.go b/profiles/internal/naming/namespace/all_test.go
index ec3ad92..1349e42 100644
--- a/profiles/internal/naming/namespace/all_test.go
+++ b/profiles/internal/naming/namespace/all_test.go
@@ -89,8 +89,8 @@
 	}
 	for s := range rc {
 		switch v := s.(type) {
-		case *naming.MountEntry:
-			replies = append(replies, v.Name)
+		case *naming.GlobReplyEntry:
+			replies = append(replies, v.Value.Name)
 			if limit > 0 && len(replies) > limit {
 				boom(t, "Glob returns too many results, perhaps not limiting recursion")
 			}
@@ -773,10 +773,10 @@
 	}
 	count := 0
 	for result := range c {
-		if me, ok := result.(*naming.MountEntry); ok {
+		if me, ok := result.(*naming.GlobReplyEntry); ok {
 			count++
-			if expected := true; me.IsLeaf != expected {
-				boom(t, "unexpected me.IsLeaf value. Got %v, expected %v", me.IsLeaf, expected)
+			if expected := true; me.Value.IsLeaf != expected {
+				boom(t, "unexpected me.IsLeaf value. Got %v, expected %v", me.Value.IsLeaf, expected)
 			}
 		}
 	}
diff --git a/profiles/internal/naming/namespace/glob.go b/profiles/internal/naming/namespace/glob.go
index f3c30b8..451dc5b 100644
--- a/profiles/internal/naming/namespace/glob.go
+++ b/profiles/internal/naming/namespace/glob.go
@@ -147,7 +147,7 @@
 }
 
 // globLoop fires off a go routine for each server and read backs replies.
-func (ns *namespace) globLoop(ctx *context.T, e *naming.MountEntry, prefix string, pattern *glob.Glob, reply chan interface{}, tr *tracks, opts []rpc.CallOpt) {
+func (ns *namespace) globLoop(ctx *context.T, e *naming.MountEntry, prefix string, pattern *glob.Glob, reply chan naming.GlobReply, tr *tracks, opts []rpc.CallOpt) {
 	defer close(reply)
 
 	// Provide enough buffers to avoid too much switching between the readers and the writers.
@@ -183,8 +183,7 @@
 			// If no tasks are running, return.
 			if t.error != nil {
 				if !notAnMT(t.error) {
-					x := naming.GlobError{Name: naming.Join(prefix, t.me.Name), Error: t.error}
-					reply <- &x
+					reply <- naming.GlobReplyError{naming.GlobError{Name: naming.Join(prefix, t.me.Name), Error: t.error}}
 				}
 				if inFlight--; inFlight <= 0 {
 					return
@@ -196,7 +195,7 @@
 			if t.er != nil {
 				x := *t.er
 				x.Name = naming.Join(prefix, x.Name)
-				reply <- &x
+				reply <- &naming.GlobReplyError{x}
 				continue
 			}
 
@@ -208,7 +207,7 @@
 			if suffix.Len() == 0 && t.depth != 0 {
 				x := *t.me
 				x.Name = naming.Join(prefix, x.Name)
-				reply <- &x
+				reply <- &naming.GlobReplyEntry{x}
 			}
 
 			// If the pattern is finished (so we're only querying about the root on the
@@ -235,7 +234,7 @@
 }
 
 // Glob implements naming.MountTable.Glob.
-func (ns *namespace) Glob(ctx *context.T, pattern string, opts ...naming.NamespaceOpt) (chan interface{}, error) {
+func (ns *namespace) Glob(ctx *context.T, pattern string, opts ...naming.NamespaceOpt) (chan naming.GlobReply, error) {
 	defer vlog.LogCall()()
 	// Root the pattern.  If we have no servers to query, give up.
 	e, patternWasRooted := ns.rootMountEntry(pattern)
@@ -259,7 +258,7 @@
 		prefix = e.Servers[0].Server
 	}
 	e.Name = ""
-	reply := make(chan interface{}, 100)
+	reply := make(chan naming.GlobReply, 100)
 	go ns.globLoop(ctx, e, prefix, g, reply, tr, getCallOpts(opts))
 	return reply, nil
 }
diff --git a/profiles/internal/testing/mocks/naming/namespace.go b/profiles/internal/testing/mocks/naming/namespace.go
index 6a7e1ef..f65ba16 100644
--- a/profiles/internal/testing/mocks/naming/namespace.go
+++ b/profiles/internal/testing/mocks/naming/namespace.go
@@ -141,7 +141,7 @@
 	return nil
 }
 
-func (ns *namespaceMock) Glob(ctx *context.T, pattern string, opts ...naming.NamespaceOpt) (chan interface{}, error) {
+func (ns *namespaceMock) Glob(ctx *context.T, pattern string, opts ...naming.NamespaceOpt) (chan naming.GlobReply, error) {
 	defer vlog.LogCall()()
 	// TODO(mattr): Implement this method for tests that might need it.
 	panic("Glob not implemented")
diff --git a/profiles/roaming/roaminginit.go b/profiles/roaming/roaminginit.go
index 342422d..f09f1c6 100644
--- a/profiles/roaming/roaminginit.go
+++ b/profiles/roaming/roaminginit.go
@@ -4,10 +4,9 @@
 
 // +build linux darwin
 
-// Package roaming provides a network-aware Profile that provides appropriate
-// options and configuration for a variety of network configurations, including
-// being behind 1-1 NATs, using dhcp and auto-configuration for being on
-// Google Compute Engine.
+// Package roaming implements a profile suitable for a variety of network
+// configurations, including 1-1 NATs, dhcp auto-configuration, and Google
+// Compute Engine.
 //
 // The config.Publisher mechanism is used for communicating networking
 // settings to the rpc.Server implementation of the runtime and publishes
diff --git a/profiles/static/staticinit.go b/profiles/static/staticinit.go
index 7da5a31..1908308 100644
--- a/profiles/static/staticinit.go
+++ b/profiles/static/staticinit.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package static implements a profile for static network configurations.
 package static
 
 import (
diff --git a/services/agent/client.go b/services/agent/client.go
index 9abb091..64cd670 100644
--- a/services/agent/client.go
+++ b/services/agent/client.go
@@ -18,8 +18,8 @@
 	"v.io/v23/security"
 	"v.io/v23/vtrace"
 	"v.io/x/lib/vlog"
-	"v.io/x/ref/lib/unixfd"
 	"v.io/x/ref/services/agent/internal/cache"
+	"v.io/x/ref/services/agent/internal/unixfd"
 )
 
 // FdVarName is the name of the environment variable containing
diff --git a/lib/unixfd/unixfd.go b/services/agent/internal/unixfd/unixfd.go
similarity index 98%
rename from lib/unixfd/unixfd.go
rename to services/agent/internal/unixfd/unixfd.go
index a80e1d9..6d4328d 100644
--- a/lib/unixfd/unixfd.go
+++ b/services/agent/internal/unixfd/unixfd.go
@@ -21,7 +21,7 @@
 	"v.io/v23/verror"
 )
 
-const pkgPath = "v.io/x/ref/lib/unixfd"
+const pkgPath = "v.io/x/ref/services/agent/internal/unixfd"
 
 var (
 	errListenerClosed            = verror.Register(pkgPath+".errListenerClosed", verror.NoRetry, "{1:}{2:} listener closed{:_}")
diff --git a/lib/unixfd/unixfd_test.go b/services/agent/internal/unixfd/unixfd_test.go
similarity index 100%
rename from lib/unixfd/unixfd_test.go
rename to services/agent/internal/unixfd/unixfd_test.go
diff --git a/services/agent/keymgr/client.go b/services/agent/keymgr/client.go
index 925f867..d6c34a3 100644
--- a/services/agent/keymgr/client.go
+++ b/services/agent/keymgr/client.go
@@ -14,7 +14,7 @@
 
 	"v.io/v23/context"
 	"v.io/v23/verror"
-	"v.io/x/ref/lib/unixfd"
+	"v.io/x/ref/services/agent/internal/unixfd"
 	"v.io/x/ref/services/agent/server"
 )
 
diff --git a/services/agent/server/server.go b/services/agent/server/server.go
index ac03233..6710b1a 100644
--- a/services/agent/server/server.go
+++ b/services/agent/server/server.go
@@ -26,7 +26,7 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 	vsecurity "v.io/x/ref/lib/security"
-	"v.io/x/ref/lib/unixfd"
+	"v.io/x/ref/services/agent/internal/unixfd"
 )
 
 const PrincipalHandleByteSize = sha512.Size
diff --git a/services/application/application/doc.go b/services/application/application/doc.go
index eed1111..491f801 100644
--- a/services/application/application/doc.go
+++ b/services/application/application/doc.go
@@ -6,8 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The application tool facilitates interaction with the vanadium application
-repository.
+Command application manages the Vanadium application repository.
 
 Usage:
    application <command>
@@ -40,7 +39,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
diff --git a/services/application/application/impl.go b/services/application/application/impl.go
index c0b5e1d..de18364 100644
--- a/services/application/application/impl.go
+++ b/services/application/application/impl.go
@@ -229,10 +229,9 @@
 func root() *cmdline.Command {
 	return &cmdline.Command{
 		Name:  "application",
-		Short: "Tool for interacting with the vanadium application repository",
+		Short: "manages the Vanadium application repository",
 		Long: `
-The application tool facilitates interaction with the vanadium application
-repository.
+Command application manages the Vanadium application repository.
 `,
 		Children: []*cmdline.Command{cmdMatch, cmdPut, cmdRemove, cmdEdit},
 	}
diff --git a/services/application/applicationd/main.go b/services/application/applicationd/main.go
index d8a0b1d..28a4012 100644
--- a/services/application/applicationd/main.go
+++ b/services/application/applicationd/main.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon applicationd implements the v.io/x/ref/services/repository.Application
+// interface.
 package main
 
 import (
diff --git a/services/binary/binary/doc.go b/services/binary/binary/doc.go
index bd9f9b5..be451bf 100644
--- a/services/binary/binary/doc.go
+++ b/services/binary/binary/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The binary tool facilitates interaction with the vanadium binary repository.
+Command binary manages the Vanadium binary repository.
 
 Usage:
    binary <command>
@@ -38,7 +38,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
diff --git a/services/binary/binary/impl.go b/services/binary/binary/impl.go
index 6b9add4..75e80b4 100644
--- a/services/binary/binary/impl.go
+++ b/services/binary/binary/impl.go
@@ -9,7 +9,7 @@
 	"os"
 
 	"v.io/x/lib/cmdline"
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 )
 
 var cmdDelete = &cmdline.Command{
@@ -125,9 +125,9 @@
 func root() *cmdline.Command {
 	return &cmdline.Command{
 		Name:  "binary",
-		Short: "Tool for interacting with the vanadium binary repository",
+		Short: "manages the Vanadium binary repository",
 		Long: `
-The binary tool facilitates interaction with the vanadium binary repository.
+Command binary manages the Vanadium binary repository.
 `,
 		Children: []*cmdline.Command{cmdDelete, cmdDownload, cmdUpload, cmdURL},
 	}
diff --git a/services/binary/binaryd/main.go b/services/binary/binaryd/main.go
index d0a48c5..e5fdc80 100644
--- a/services/binary/binaryd/main.go
+++ b/services/binary/binaryd/main.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon binaryd implements the v.io/v23/services/repository.Binary interface.
 package main
 
 import (
@@ -17,7 +18,7 @@
 	"v.io/x/lib/netstate"
 	"v.io/x/ref/lib/signals"
 	_ "v.io/x/ref/profiles/roaming"
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 )
 
 const defaultDepth = 3
diff --git a/services/build/build/doc.go b/services/build/build/doc.go
index a5ae097..2952467 100644
--- a/services/build/build/doc.go
+++ b/services/build/build/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The build tool tool facilitates interaction with the vanadium build server.
+Command build sends commands to a Vanadium build server.
 
 Usage:
    build <command>
@@ -35,7 +35,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
@@ -73,10 +73,10 @@
 wildcard match against all packages with that prefix.
 
 The build build flags are:
- -arch=${GOARCH}
-   Target architecture.
- -os=${GOOS}
-   Target operating system.
+ -arch=<runtime.GOARCH>
+   Target architecture.  The default is the value of runtime.GOARCH.
+ -os=<runtime.GOOS>
+   Target operating system.  The default is the value of runtime.GOOS.
 
 Build Help
 
diff --git a/services/build/build/impl.go b/services/build/build/impl.go
index cedcff6..8f96f38 100644
--- a/services/build/build/impl.go
+++ b/services/build/build/impl.go
@@ -5,12 +5,12 @@
 package main
 
 import (
-	"flag"
 	"fmt"
 	"go/build"
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"time"
 
@@ -19,28 +19,23 @@
 	"v.io/x/lib/cmdline"
 )
 
-const (
-	defaultArch = "${GOARCH}"
-	defaultOS   = "${GOOS}"
-)
-
 var (
-	flagArch flag.Getter
-	flagOS   flag.Getter
+	flagArch string
+	flagOS   string
 )
 
 func init() {
-	flagArch = cmdline.RuntimeFlag(defaultArch)
-	flagOS = cmdline.RuntimeFlag(defaultOS)
-	cmdBuild.Flags.Var(flagArch, "arch", "Target architecture.")
-	cmdBuild.Flags.Var(flagOS, "os", "Target operating system.")
+	cmdBuild.Flags.StringVar(&flagArch, "arch", runtime.GOARCH, "Target architecture.  The default is the value of runtime.GOARCH.")
+	cmdBuild.Flags.Lookup("arch").DefValue = "<runtime.GOARCH>"
+	cmdBuild.Flags.StringVar(&flagOS, "os", runtime.GOOS, "Target operating system.  The default is the value of runtime.GOOS.")
+	cmdBuild.Flags.Lookup("os").DefValue = "<runtime.GOOS>"
 }
 
 var cmdRoot = &cmdline.Command{
 	Name:  "build",
-	Short: "Tool for interacting with the vanadium build server",
+	Short: "sends commands to a Vanadium build server",
 	Long: `
-The build tool tool facilitates interaction with the vanadium build server.
+Command build sends commands to a Vanadium build server.
 `,
 	Children: []*cmdline.Command{cmdBuild},
 }
@@ -153,8 +148,17 @@
 		defer cancel()
 
 		client := vbuild.BuilderClient(name)
-		arch, os := flagArch.Get().(string), flagOS.Get().(string)
-		stream, err := client.Build(ctx, vbuild.Architecture(arch), vbuild.OperatingSystem(os))
+		var arch vbuild.Architecture
+		if err := arch.SetFromGoArch(flagArch); err != nil {
+			errchan <- err
+			return
+		}
+		var os vbuild.OperatingSystem
+		if err := os.SetFromGoOS(flagOS); err != nil {
+			errchan <- err
+			return
+		}
+		stream, err := client.Build(ctx, arch, os)
 		if err != nil {
 			errchan <- fmt.Errorf("Build() failed: %v", err)
 			return
diff --git a/services/build/buildd/impl_test.go b/services/build/buildd/impl_test.go
index ffce344..dacf6eb 100644
--- a/services/build/buildd/impl_test.go
+++ b/services/build/buildd/impl_test.go
@@ -46,6 +46,23 @@
 	return pathbin, os.Getenv("GOROOT")
 }
 
+// getArch returns an Architecture representing the host architecture.
+func getArch(t *testing.T) (arch build.Architecture) {
+	if err := arch.SetFromGoArch(runtime.GOARCH); err != nil {
+		t.Fatalf("%v", err)
+	}
+	return
+}
+
+// getOS returns an OperatingSystem representing the host operating
+// system.
+func getOS(t *testing.T) (os build.OperatingSystem) {
+	if err := os.SetFromGoOS(runtime.GOOS); err != nil {
+		t.Fatalf("%v", err)
+	}
+	return
+}
+
 // startServer starts the build server.
 func startServer(t *testing.T, ctx *context.T) build.BuilderClientMethods {
 	gobin, goroot := findGoBinary(t, "go")
@@ -67,12 +84,12 @@
 }
 
 func invokeBuild(t *testing.T, ctx *context.T, client build.BuilderClientMethods, files []build.File) ([]byte, []build.File, error) {
-	arch, opsys := getArch(), getOS()
+	arch, os := getArch(t), getOS(t)
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
-	stream, err := client.Build(ctx, arch, opsys)
+	stream, err := client.Build(ctx, arch, os)
 	if err != nil {
-		t.Errorf("Build(%v, %v) failed: %v", err, arch, opsys)
+		t.Errorf("Build(%v, %v) failed: %v", err, arch, os)
 		return nil, nil, err
 	}
 	sender := stream.SendStream()
diff --git a/services/build/buildd/main.go b/services/build/buildd/main.go
index c2b05de..71edc14 100644
--- a/services/build/buildd/main.go
+++ b/services/build/buildd/main.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon buildd implements the v.io/v23/services/build.Builder interface.
 package main
 
 import (
diff --git a/services/build/buildd/service.go b/services/build/buildd/service.go
index b6e80a5b..b28dbc8 100644
--- a/services/build/buildd/service.go
+++ b/services/build/buildd/service.go
@@ -12,6 +12,7 @@
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	"v.io/v23/rpc"
 	"v.io/v23/services/binary"
@@ -80,13 +81,14 @@
 		vlog.Errorf("Advance() failed: %v", err)
 		return nil, verror.New(verror.ErrInternal, call.Context())
 	}
-	// NOTE: we actually want run "go install -v {srcDir}/..." here, but the go
-	// tool seems to have a bug where it doesn't interpret rooted (absolute) with
-	// wildcards correctly.  So we run "go install -v all" instead, which has the
-	// downside that it might cause some standard packages to be built spuriously.
+	// NOTE: we actually want run "go install -v {srcDir}/..." here, but
+	// the go tool seems to have a bug where it doesn't interpret rooted
+	// (absolute) paths with wildcards correctly.  So we run "go install
+	// -v all" instead, which has the downside that it might cause some
+	// standard packages to be built spuriously.
 	cmd := exec.Command(i.gobin, "install", "-v", "all")
-	cmd.Env = append(cmd.Env, "GOARCH="+string(arch))
-	cmd.Env = append(cmd.Env, "GOOS="+string(opsys))
+	cmd.Env = append(cmd.Env, "GOARCH="+arch.ToGoArch())
+	cmd.Env = append(cmd.Env, "GOOS="+opsys.ToGoOS())
 	cmd.Env = append(cmd.Env, "GOPATH="+filepath.Dir(srcDir))
 	if i.goroot != "" {
 		cmd.Env = append(cmd.Env, "GOROOT="+i.goroot)
@@ -95,7 +97,7 @@
 	cmd.Stdout = &output
 	cmd.Stderr = &output
 	if err := cmd.Run(); err != nil {
-		vlog.Errorf("Run() failed: %v", err)
+		vlog.Errorf("Run(%q) failed: %v", strings.Join(cmd.Args, " "), err)
 		if output.Len() != 0 {
 			vlog.Errorf("%v", output.String())
 		}
@@ -107,8 +109,8 @@
 		vlog.Errorf("Arch() failed: %v", err)
 		return nil, verror.New(verror.ErrInternal, call.Context())
 	}
-	if machineArch != string(arch) || runtime.GOOS != string(opsys) {
-		binDir = filepath.Join(binDir, fmt.Sprintf("%v_%v", string(opsys), string(arch)))
+	if machineArch != arch.ToGoArch() || runtime.GOOS != opsys.ToGoOS() {
+		binDir = filepath.Join(binDir, fmt.Sprintf("%v_%v", opsys.ToGoOS(), arch.ToGoArch()))
 	}
 	files, err := ioutil.ReadDir(binDir)
 	if err != nil && !os.IsNotExist(err) {
diff --git a/services/build/buildd/util.go b/services/build/buildd/util.go
deleted file mode 100644
index 5215863..0000000
--- a/services/build/buildd/util.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2015 The Vanadium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package main
-
-import (
-	"runtime"
-
-	"v.io/v23/services/build"
-)
-
-func getArch() build.Architecture {
-	switch runtime.GOARCH {
-	case "386", "amd64", "arm":
-		return build.Architecture(runtime.GOARCH)
-	default:
-		return build.UnsupportedArchitecture
-	}
-}
-
-func getOS() build.OperatingSystem {
-	switch runtime.GOOS {
-	case "darwin", "linux", "windows":
-		return build.OperatingSystem(runtime.GOOS)
-	default:
-		return build.UnsupportedOS
-	}
-}
diff --git a/services/debug/debug/doc.go b/services/debug/debug/doc.go
index 0283fff..7034069 100644
--- a/services/debug/debug/doc.go
+++ b/services/debug/debug/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-Command-line tool for interacting with the debug server.
+Command debug supports debugging Vanadium servers.
 
 Usage:
    debug <command>
@@ -39,7 +39,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
diff --git a/services/debug/debug/impl.go b/services/debug/debug/impl.go
index 8ec5265..14873ea 100644
--- a/services/debug/debug/impl.go
+++ b/services/debug/debug/impl.go
@@ -28,7 +28,7 @@
 	"v.io/x/lib/cmdline"
 	"v.io/x/ref/lib/glob"
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/services/pprof/pproflib"
+	"v.io/x/ref/services/internal/pproflib"
 )
 
 var (
@@ -149,7 +149,7 @@
 	if min, got := 1, len(args); got < min {
 		return cmd.UsageErrorf("glob: incorrect number of arguments, got %d, want >=%d", got, min)
 	}
-	results := make(chan interface{})
+	results := make(chan naming.GlobReply)
 	errors := make(chan error)
 	doGlobs(gctx, args, results, errors)
 	var lastErr error
@@ -163,14 +163,14 @@
 				return lastErr
 			}
 			switch v := me.(type) {
-			case *naming.MountEntry:
-				fmt.Fprint(cmd.Stdout(), v.Name)
-				for _, s := range v.Servers {
+			case *naming.GlobReplyEntry:
+				fmt.Fprint(cmd.Stdout(), v.Value.Name)
+				for _, s := range v.Value.Servers {
 					fmt.Fprintf(cmd.Stdout(), " %s (Deadline %s)", s.Server, s.Deadline.Time)
 				}
 				fmt.Fprintln(cmd.Stdout())
-			case *naming.GlobError:
-				fmt.Fprintf(cmd.Stderr(), "Error: %s: %v\n", v.Name, v.Error)
+			case *naming.GlobReplyError:
+				fmt.Fprintf(cmd.Stderr(), "Error: %s: %v\n", v.Value.Name, v.Value.Error)
 			}
 		}
 	}
@@ -179,7 +179,7 @@
 // doGlobs calls Glob on multiple patterns in parallel and sends all the results
 // on the results channel and all the errors on the errors channel. It closes
 // the results channel when all the results have been sent.
-func doGlobs(ctx *context.T, patterns []string, results chan<- interface{}, errors chan<- error) {
+func doGlobs(ctx *context.T, patterns []string, results chan<- naming.GlobReply, errors chan<- error) {
 	var wg sync.WaitGroup
 	wg.Add(len(patterns))
 	for _, p := range patterns {
@@ -191,7 +191,7 @@
 	}()
 }
 
-func doGlob(ctx *context.T, pattern string, results chan<- interface{}, errors chan<- error, wg *sync.WaitGroup) {
+func doGlob(ctx *context.T, pattern string, results chan<- naming.GlobReply, errors chan<- error, wg *sync.WaitGroup) {
 	defer wg.Done()
 	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
@@ -289,7 +289,7 @@
 	if min, got := 1, len(args); got < min {
 		return cmd.UsageErrorf("read: incorrect number of arguments, got %d, want >=%d", got, min)
 	}
-	globResults := make(chan interface{})
+	globResults := make(chan naming.GlobReply)
 	errors := make(chan error)
 	doGlobs(gctx, args, globResults, errors)
 
@@ -298,9 +298,9 @@
 		var wg sync.WaitGroup
 		for me := range globResults {
 			switch v := me.(type) {
-			case *naming.MountEntry:
+			case *naming.GlobReplyEntry:
 				wg.Add(1)
-				go doValue(gctx, v.Name, output, errors, &wg)
+				go doValue(gctx, v.Value.Name, output, errors, &wg)
 			}
 		}
 		wg.Wait()
@@ -548,8 +548,8 @@
 
 var cmdRoot = cmdline.Command{
 	Name:  "debug",
-	Short: "Command-line tool for interacting with the debug server.",
-	Long:  "Command-line tool for interacting with the debug server.",
+	Short: "supports debugging Vanadium servers.",
+	Long:  "Command debug supports debugging Vanadium servers.",
 	Children: []*cmdline.Command{
 		cmdGlob,
 		cmdVtrace,
diff --git a/services/debug/debuglib/dispatcher.go b/services/debug/debuglib/dispatcher.go
index 55f44a5..ce4dc26 100644
--- a/services/debug/debuglib/dispatcher.go
+++ b/services/debug/debuglib/dispatcher.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package debuglib implements debug server support.
 package debuglib
 
 import (
@@ -10,11 +11,10 @@
 
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-
-	"v.io/x/ref/services/logreader/logreaderlib"
-	"v.io/x/ref/services/pprof/pproflib"
-	"v.io/x/ref/services/stats/statslib"
-	"v.io/x/ref/services/vtrace/vtracelib"
+	"v.io/x/ref/services/internal/logreaderlib"
+	"v.io/x/ref/services/internal/pproflib"
+	"v.io/x/ref/services/internal/statslib"
+	"v.io/x/ref/services/internal/vtracelib"
 )
 
 // dispatcher holds the state of the debug dispatcher.
diff --git a/services/debug/debuglib/dispatcher_test.go b/services/debug/debuglib/dispatcher_test.go
index 00cdea1..6bc48d7 100644
--- a/services/debug/debuglib/dispatcher_test.go
+++ b/services/debug/debuglib/dispatcher_test.go
@@ -185,8 +185,8 @@
 		results := []string{}
 		for res := range c {
 			switch v := res.(type) {
-			case *naming.MountEntry:
-				results = append(results, v.Name)
+			case *naming.GlobReplyEntry:
+				results = append(results, v.Value.Name)
 			}
 		}
 		sort.Strings(results)
@@ -206,8 +206,8 @@
 		for res := range c {
 			t.Logf("got %v", res)
 			switch v := res.(type) {
-			case *naming.MountEntry:
-				results = append(results, v.Name)
+			case *naming.GlobReplyEntry:
+				results = append(results, v.Value.Name)
 			}
 		}
 		sort.Strings(results)
@@ -225,8 +225,8 @@
 		results = []string{}
 		for res := range c {
 			switch v := res.(type) {
-			case *naming.MountEntry:
-				results = append(results, v.Name)
+			case *naming.GlobReplyEntry:
+				results = append(results, v.Value.Name)
 			}
 		}
 		sort.Strings(results)
@@ -247,12 +247,12 @@
 		results = []string{}
 		for res := range c {
 			switch v := res.(type) {
-			case *naming.MountEntry:
-				if strings.HasPrefix(v.Name, "stats/") && !strings.HasPrefix(v.Name, "stats/testing/") {
+			case *naming.GlobReplyEntry:
+				if strings.HasPrefix(v.Value.Name, "stats/") && !strings.HasPrefix(v.Value.Name, "stats/testing/") {
 					// Skip any non-testing stats.
 					continue
 				}
-				results = append(results, v.Name)
+				results = append(results, v.Value.Name)
 			}
 		}
 		sort.Strings(results)
diff --git a/services/device/device/devicemanager_mock_test.go b/services/device/device/devicemanager_mock_test.go
index 7c8e2d8..6bed75f 100644
--- a/services/device/device/devicemanager_mock_test.go
+++ b/services/device/device/devicemanager_mock_test.go
@@ -24,7 +24,7 @@
 	"v.io/v23/services/repository"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/services/internal/packages"
 )
 
diff --git a/services/device/device/doc.go b/services/device/device/doc.go
index a9a06ad..db801e0 100644
--- a/services/device/device/doc.go
+++ b/services/device/device/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The device tool facilitates interaction with the vanadium device manager.
+Command device facilitates interaction with the Vanadium device manager.
 
 Usage:
    device <command>
@@ -38,6 +38,8 @@
    log to standard error as well as files
  -dryrun=false
    Elides root-requiring systemcalls.
+ -kill=false
+   Kill process ids given as command-line arguments.
  -log_backtrace_at=:0
    when logging hits line file:N, emit a stack trace
  -log_dir=
@@ -66,7 +68,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.permissions.file=map[]
    specify an acl file as <name>:<aclfile>
@@ -384,10 +386,10 @@
    Name of application service.
  -binserv=binaries
    Name of binary service.
- -goarch=${GOARCH}
-   GOARCH for application.
- -goos=${GOOS}
-   GOOS for application.
+ -goarch=<runtime.GOARCH>
+   GOARCH for application.  The default is the value of runtime.GOARCH.
+ -goos=<runtime.GOOS>
+   GOOS for application.  The default is the value of runtime.GOOS.
  -readers=dev.v.io
    If non-empty, comma-separated blessing patterns to add to Read and Resolve
    AccessList.
diff --git a/services/device/device/publish.go b/services/device/device/publish.go
index 828aaad..ad62461 100644
--- a/services/device/device/publish.go
+++ b/services/device/device/publish.go
@@ -5,7 +5,6 @@
 package main
 
 import (
-	"flag"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -21,7 +20,7 @@
 	"v.io/v23/verror"
 
 	"v.io/x/lib/cmdline"
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/services/repository"
 )
 
@@ -42,25 +41,15 @@
 	ArgsName: "<binary name> ...",
 }
 
-var binaryService, applicationService, readBlessings string
-
-const (
-	defaultArch = "$GOARCH"
-	defaultOS   = "$GOOS"
-)
-
-var (
-	goarchFlag flag.Getter
-	goosFlag   flag.Getter
-)
+var binaryService, applicationService, readBlessings, goarchFlag, goosFlag string
 
 func init() {
 	cmdPublish.Flags.StringVar(&binaryService, "binserv", "binaries", "Name of binary service.")
 	cmdPublish.Flags.StringVar(&applicationService, "appserv", "applications", "Name of application service.")
-	goosFlag = cmdline.RuntimeFlag("${GOOS}")
-	goarchFlag = cmdline.RuntimeFlag("${GOARCH}")
-	cmdPublish.Flags.Var(goosFlag, "goos", "GOOS for application.")
-	cmdPublish.Flags.Var(goarchFlag, "goarch", "GOARCH for application.")
+	cmdPublish.Flags.StringVar(&goosFlag, "goos", runtime.GOOS, "GOOS for application.  The default is the value of runtime.GOOS.")
+	cmdPublish.Flags.Lookup("goos").DefValue = "<runtime.GOOS>"
+	cmdPublish.Flags.StringVar(&goarchFlag, "goarch", runtime.GOARCH, "GOARCH for application.  The default is the value of runtime.GOARCH.")
+	cmdPublish.Flags.Lookup("goarch").DefValue = "<runtime.GOARCH>"
 	cmdPublish.Flags.StringVar(&readBlessings, "readers", "dev.v.io", "If non-empty, comma-separated blessing patterns to add to Read and Resolve AccessList.")
 }
 
@@ -90,15 +79,12 @@
 }
 
 func publishOne(cmd *cmdline.Command, binPath, binaryName string) error {
-	goos := goosFlag.Get().(string)
-	goarch := goarchFlag.Get().(string)
-
 	// Step 1, upload the binary to the binary service.
 
 	// TODO(caprita): Instead of the current timestamp, use each binary's
 	// BuildTimestamp from the buildinfo.
 	timestamp := time.Now().UTC().Format(time.RFC3339)
-	binaryVON := naming.Join(binaryService, binaryName, fmt.Sprintf("%s-%s", goos, goarch), timestamp)
+	binaryVON := naming.Join(binaryService, binaryName, fmt.Sprintf("%s-%s", goosFlag, goarchFlag), timestamp)
 	binaryFile := filepath.Join(binPath, binaryName)
 	// TODO(caprita): Take signature of binary and put it in the envelope.
 	if _, err := binarylib.UploadFromFile(gctx, binaryVON, binaryFile); err != nil {
@@ -117,7 +103,7 @@
 
 	// TODO(caprita): use the profile detection machinery and/or let user
 	// specify profiles by hand.
-	profiles := []string{fmt.Sprintf("%s-%s", goos, goarch)}
+	profiles := []string{fmt.Sprintf("%s-%s", goosFlag, goarchFlag)}
 	// TODO(caprita): use a label e.g. "prod" instead of "0".
 	appVON := naming.Join(applicationService, binaryName, "0")
 	appClient := repository.ApplicationClient(appVON)
@@ -155,10 +141,8 @@
 		return cmd.UsageErrorf("publish: $V23_ROOT environment variable should be set")
 	}
 	binPath := filepath.Join(vroot, "release/go/bin")
-	goos := goosFlag.Get().(string)
-	goarch := goarchFlag.Get().(string)
-	if goos != runtime.GOOS || goarch != runtime.GOARCH {
-		binPath = filepath.Join(binPath, fmt.Sprintf("%s_%s", goos, goarch))
+	if goosFlag != runtime.GOOS || goarchFlag != runtime.GOARCH {
+		binPath = filepath.Join(binPath, fmt.Sprintf("%s_%s", goosFlag, goarchFlag))
 	}
 	if fi, err := os.Stat(binPath); err != nil {
 		return cmd.UsageErrorf("publish: failed to stat %v: %v", binPath, err)
diff --git a/services/device/device/root.go b/services/device/device/root.go
index c65b317..8f680c1 100644
--- a/services/device/device/root.go
+++ b/services/device/device/root.go
@@ -19,9 +19,9 @@
 func Root() *cmdline.Command {
 	return &cmdline.Command{
 		Name:  "device",
-		Short: "Tool for interacting with the vanadium device manager",
+		Short: "facilitates interaction with the Vanadium device manager",
 		Long: `
-The device tool facilitates interaction with the vanadium device manager.
+Command device facilitates interaction with the Vanadium device manager.
 `,
 		Children: []*cmdline.Command{cmdInstall, cmdInstallLocal, cmdUninstall, cmdStart, associateRoot(), cmdDescribe, cmdClaim, cmdStop, cmdSuspend, cmdResume, cmdRevert, cmdUpdate, cmdUpdateAll, cmdStatus, cmdDebug, aclRoot(), cmdPublish},
 	}
diff --git a/services/device/device/updateall.go b/services/device/device/updateall.go
index 551ae5b..113cfc1 100644
--- a/services/device/device/updateall.go
+++ b/services/device/device/updateall.go
@@ -58,18 +58,18 @@
 	)
 	for res := range c {
 		switch v := res.(type) {
-		case *naming.MountEntry:
+		case *naming.GlobReplyEntry:
 			pending.Add(1)
 			go func() {
-				if err := updateChild(cmd, v.Name); err != nil {
+				if err := updateChild(cmd, v.Value.Name); err != nil {
 					numErrorsMu.Lock()
 					numErrors++
 					numErrorsMu.Unlock()
 				}
 				pending.Done()
 			}()
-		case *naming.GlobError:
-			fmt.Fprintf(cmd.Stderr(), "Glob error for %q: %v\n", v.Name, v.Error)
+		case *naming.GlobReplyError:
+			fmt.Fprintf(cmd.Stderr(), "Glob error for %q: %v\n", v.Value.Name, v.Value.Error)
 			numErrorsMu.Lock()
 			numErrors++
 			numErrorsMu.Unlock()
diff --git a/services/device/deviced/main.go b/services/device/deviced/main.go
index b63d710..1e23e55 100644
--- a/services/device/deviced/main.go
+++ b/services/device/deviced/main.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon deviced implements the v.io/v23/services/device interfaces.
 package main
 
 import (
diff --git a/services/device/doc.go b/services/device/doc.go
index 92919c7..6309631 100644
--- a/services/device/doc.go
+++ b/services/device/doc.go
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package device contains the implementation for the v.io/v23//mgmt/device APIs.
+// Package device defines interfaces for configuration of the Vanadium device
+// manager.  The subdirectories implement the v.io/v23/services/device
+// interfaces.
 //
 // The device manager is a server that is expected to run on every
 // Vanadium-enabled device, and it handles both device management and management
diff --git a/services/device/inithelper/main.go b/services/device/inithelper/main.go
index 4916c28..7e3301e 100644
--- a/services/device/inithelper/main.go
+++ b/services/device/inithelper/main.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Command inithelper manages services for a variety of platforms and init
+// systems, such as upstart, systemd etc.
 package main
 
 // TODO(caprita): The separation of responsibilities between root/non-root code
@@ -18,7 +20,7 @@
 	"fmt"
 	"os"
 
-	"v.io/x/ref/lib/sysinit"
+	"v.io/x/ref/services/device/internal/sysinit"
 )
 
 func usage() {
diff --git a/services/device/internal/impl/app_starting_util.go b/services/device/internal/impl/app_starting_util.go
index 76d9bed..1170fe9 100644
--- a/services/device/internal/impl/app_starting_util.go
+++ b/services/device/internal/impl/app_starting_util.go
@@ -22,7 +22,7 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 	vexec "v.io/x/ref/lib/exec"
-	"v.io/x/ref/lib/suid"
+	"v.io/x/ref/services/device/internal/suid"
 )
 
 // appWatcher watches the pid of a running app until either the pid exits or stop()
diff --git a/services/device/internal/impl/device_installer.go b/services/device/internal/impl/device_installer.go
index 01bdeb7..4d66a49 100644
--- a/services/device/internal/impl/device_installer.go
+++ b/services/device/internal/impl/device_installer.go
@@ -57,8 +57,8 @@
 	"v.io/v23/services/application"
 
 	"v.io/x/ref/envvar"
-	"v.io/x/ref/lib/sysinit"
 	"v.io/x/ref/services/device/internal/config"
+	"v.io/x/ref/services/device/internal/sysinit"
 )
 
 // restartExitCode is the exit code that the device manager should return when it
@@ -284,6 +284,12 @@
 	}
 	cmd := exec.Command(helperPath)
 	cmd.Args = append(cmd.Args, "--rm", root)
+	if stderr != nil {
+		cmd.Stderr = stderr
+	}
+	if stdout != nil {
+		cmd.Stdout = stdout
+	}
 	if err := cmd.Run(); err != nil {
 		return fmt.Errorf("devicemanager's invocation of suidhelper to remove(%v) failed: %v", root, err)
 	}
diff --git a/services/device/internal/impl/dispatcher.go b/services/device/internal/impl/dispatcher.go
index 9227d9b..da5a9a2 100644
--- a/services/device/internal/impl/dispatcher.go
+++ b/services/device/internal/impl/dispatcher.go
@@ -30,7 +30,7 @@
 	s_device "v.io/x/ref/services/device"
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/internal/acls"
-	"v.io/x/ref/services/logreader/logreaderlib"
+	"v.io/x/ref/services/internal/logreaderlib"
 )
 
 // internalState wraps state shared between different device manager
diff --git a/services/device/internal/impl/impl_test.go b/services/device/internal/impl/impl_test.go
index 521d126..fd22cce 100644
--- a/services/device/internal/impl/impl_test.go
+++ b/services/device/internal/impl/impl_test.go
@@ -45,11 +45,11 @@
 	"v.io/x/ref/envvar"
 	"v.io/x/ref/lib/mgmt"
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/lib/suid"
-	"v.io/x/ref/services/binary/binarylib"
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/impl"
 	"v.io/x/ref/services/device/internal/starter"
+	"v.io/x/ref/services/device/internal/suid"
+	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/expect"
@@ -685,7 +685,8 @@
 	}
 
 	instanceDebug := debug(t, ctx, appID, instance1ID)
-	if !strings.Contains(instanceDebug, fmt.Sprintf("Blessing Store: Default blessings: %s/forapp", test.TestBlessing)) {
+	// Verify the apps default blessings.
+	if !strings.Contains(instanceDebug, fmt.Sprintf("Default Blessings                %s/forapp", test.TestBlessing)) {
 		t.Fatalf("debug response doesn't contain expected info: %v", instanceDebug)
 	}
 
diff --git a/services/device/internal/impl/profile.go b/services/device/internal/impl/profile.go
index f21cdb3..ae181d8 100644
--- a/services/device/internal/impl/profile.go
+++ b/services/device/internal/impl/profile.go
@@ -11,10 +11,9 @@
 	"runtime"
 	"strings"
 
-	"v.io/x/ref/services/profile"
-
 	"v.io/v23/services/build"
 	"v.io/v23/services/device"
+	"v.io/x/ref/services/profile"
 )
 
 // ComputeDeviceProfile generates a description of the runtime
@@ -26,31 +25,28 @@
 func ComputeDeviceProfile() (*profile.Specification, error) {
 	result := profile.Specification{}
 
-	// Find out what the supported file format, operating system, and
+	// Find out what the supported operating system, file format, and
 	// architecture is.
-	switch runtime.GOOS {
-	case "darwin":
-		result.Format = build.MACH
-		result.Os = build.Darwin
-	case "linux":
-		result.Format = build.ELF
-		result.Os = build.Linux
-	case "windows":
-		result.Format = build.PE
-		result.Os = build.Windows
-	default:
-		return nil, errors.New("Unsupported operating system: " + runtime.GOOS)
+	var os build.OperatingSystem
+	if err := os.SetFromGoOS(runtime.GOOS); err != nil {
+		return nil, err
 	}
-	switch runtime.GOARCH {
-	case "amd64":
-		result.Arch = build.AMD64
-	case "arm":
-		result.Arch = build.ARM
-	case "x86", "386":
-		result.Arch = build.X86
+	result.Os = os
+	switch os {
+	case build.OperatingSystemDarwin:
+		result.Format = build.FormatMach
+	case build.OperatingSystemLinux:
+		result.Format = build.FormatElf
+	case build.OperatingSystemWindows:
+		result.Format = build.FormatPe
 	default:
-		return nil, errors.New("Unsupported hardware architecture: " + runtime.GOARCH)
+		return nil, errors.New("Unsupported operating system: " + os.String())
 	}
+	var arch build.Architecture
+	if err := arch.SetFromGoArch(runtime.GOARCH); err != nil {
+		return nil, err
+	}
+	result.Arch = arch
 
 	// Find out what the installed dynamically linked libraries are.
 	switch runtime.GOOS {
@@ -151,23 +147,28 @@
 		{
 			Label:       "linux-amd64",
 			Description: "",
-			Arch:        build.AMD64,
-			Os:          build.Linux,
-			Format:      build.ELF,
+			Arch:        build.ArchitectureAmd64,
+			Os:          build.OperatingSystemLinux,
+			Format:      build.FormatElf,
 		},
 		{
+			// Note that linux-386 is used instead of linux-x86 for the
+			// label to facilitate generation of a matching label string
+			// using the runtime.GOARCH value. In VDL, the 386 architecture
+			// is represented using the value X86 because the VDL grammar
+			// does not allow identifiers starting with a number.
 			Label:       "linux-386",
 			Description: "",
-			Arch:        build.X86,
-			Os:          build.Linux,
-			Format:      build.ELF,
+			Arch:        build.ArchitectureX86,
+			Os:          build.OperatingSystemLinux,
+			Format:      build.FormatElf,
 		},
 		{
 			Label:       "linux-arm",
 			Description: "",
-			Arch:        build.ARM,
-			Os:          build.Linux,
-			Format:      build.ELF,
+			Arch:        build.ArchitectureArm,
+			Os:          build.OperatingSystemLinux,
+			Format:      build.FormatElf,
 		},
 		// TODO(caprita): Add other profiles for Mac, Pi, etc.
 	}, nil
diff --git a/services/device/internal/impl/util.go b/services/device/internal/impl/util.go
index 36ec927..ce8ba53 100644
--- a/services/device/internal/impl/util.go
+++ b/services/device/internal/impl/util.go
@@ -14,8 +14,8 @@
 	"strings"
 	"time"
 
-	"v.io/x/ref/services/binary/binarylib"
 	"v.io/x/ref/services/device/internal/config"
+	"v.io/x/ref/services/internal/binarylib"
 
 	"v.io/v23/context"
 	"v.io/v23/security"
diff --git a/services/device/internal/starter/starter.go b/services/device/internal/starter/starter.go
index b0a636c..d0e814e 100644
--- a/services/device/internal/starter/starter.go
+++ b/services/device/internal/starter/starter.go
@@ -184,6 +184,18 @@
 		shutdown()
 		return nil, err
 	}
+	if args.Device.ListenSpec.Proxy != "" {
+		for {
+			p := server.Status().Proxies
+			if len(p) == 0 {
+				vlog.Infof("Waiting for proxy address to appear...")
+				time.Sleep(time.Second)
+				continue
+			}
+			vlog.Infof("Proxied address: %s", p[0].Endpoint.Name())
+			break
+		}
+	}
 	vlog.Infof("Unclaimed device manager (%v) published as %v with public_key: %s", endpoints[0].Name(), claimableServerName, base64.URLEncoding.EncodeToString(publicKey))
 	vlog.FlushLog()
 	return shutdown, nil
diff --git a/lib/suid/args.go b/services/device/internal/suid/args.go
similarity index 73%
rename from lib/suid/args.go
rename to services/device/internal/suid/args.go
index 90e9d55..10ccfac 100644
--- a/lib/suid/args.go
+++ b/services/device/internal/suid/args.go
@@ -16,7 +16,7 @@
 	"v.io/v23/verror"
 )
 
-const pkgPath = "v.io/x/ref/lib/suid"
+const pkgPath = "v.io/x/ref/services/device/internal/suid"
 
 var (
 	errUserNameMissing = verror.Register(pkgPath+".errUserNameMissing", verror.NoRetry, "{1:}{2:} --username missing{:_}")
@@ -24,6 +24,8 @@
 	errInvalidUID      = verror.Register(pkgPath+".errInvalidUID", verror.NoRetry, "{1:}{2:} user.Lookup() returned an invalid uid {3}{:_}")
 	errInvalidGID      = verror.Register(pkgPath+".errInvalidGID", verror.NoRetry, "{1:}{2:} user.Lookup() returned an invalid gid {3}{:_}")
 	errUIDTooLow       = verror.Register(pkgPath+".errUIDTooLow", verror.NoRetry, "{1:}{2:} suidhelper uid {3} is not permitted because it is less than {4}{:_}")
+	errAtoiFailed      = verror.Register(pkgPath+".errAtoiFailed", verror.NoRetry, "{1:}{2:} strconv.Atoi({3}) failed{:_}")
+	errInvalidFlags    = verror.Register(pkgPath+".errInvalidFlags", verror.NoRetry, "{1:}{2:} invalid flags ({3} are set){:_}")
 )
 
 type WorkParameters struct {
@@ -36,6 +38,8 @@
 	envv      []string
 	dryrun    bool
 	remove    bool
+	kill      bool
+	killPids  []int
 }
 
 type ArgsSavedForTest struct {
@@ -50,7 +54,7 @@
 var (
 	flagUsername, flagWorkspace, flagLogDir, flagRun, flagProgName *string
 	flagMinimumUid                                                 *int64
-	flagRemove, flagDryrun                                         *bool
+	flagRemove, flagKill, flagDryrun                               *bool
 )
 
 func init() {
@@ -66,6 +70,7 @@
 	flagProgName = fs.String("progname", "unnamed_app", "Visible name of the application, used in argv[0]")
 	flagMinimumUid = fs.Int64("minuid", uidThreshold, "UIDs cannot be less than this number.")
 	flagRemove = fs.Bool("rm", false, "Remove the file trees given as command-line arguments.")
+	flagKill = fs.Bool("kill", false, "Kill process ids given as command-line arguments.")
 	flagDryrun = fs.Bool("dryrun", false, "Elides root-requiring systemcalls.")
 }
 
@@ -82,12 +87,47 @@
 // ParseArguments populates the WorkParameter object from the provided args
 // and env strings.
 func (wp *WorkParameters) ProcessArguments(fs *flag.FlagSet, env []string) error {
+	// --rm and --kill are modal. Complain if any other flag is set along with one of those.
+	if *flagRemove || *flagKill {
+		// Count flags that are set. The device manager test always sets --minuid=1
+		// and --test.run=TestSuidHelper so when in a test, tolerate those
+		flagsToIgnore := map[string]string{}
+		if os.Getenv("V23_SUIDHELPER_TEST") != "" {
+			flagsToIgnore["minuid"] = "1"
+			flagsToIgnore["test.run"] = "TestSuidHelper"
+		}
+
+		counter := 0
+		fs.Visit(func(f *flag.Flag) {
+			if flagsToIgnore[f.Name] != f.Value.String() {
+				counter++
+			}
+		})
+
+		if counter > 1 {
+			return verror.New(errInvalidFlags, nil, counter, "--rm and --kill cannot be used with any other flag")
+		}
+	}
+
 	if *flagRemove {
 		wp.remove = true
 		wp.argv = fs.Args()
 		return nil
 	}
 
+	if *flagKill {
+		wp.kill = true
+		for _, p := range fs.Args() {
+			pid, err := strconv.Atoi(p)
+			if err != nil {
+				wp.killPids = nil
+				return verror.New(errAtoiFailed, nil, p, err)
+			}
+			wp.killPids = append(wp.killPids, pid)
+		}
+		return nil
+	}
+
 	username := *flagUsername
 	if username == "" {
 		return verror.New(errUserNameMissing, nil)
diff --git a/lib/suid/args_darwin_test.go b/services/device/internal/suid/args_darwin_test.go
similarity index 100%
rename from lib/suid/args_darwin_test.go
rename to services/device/internal/suid/args_darwin_test.go
diff --git a/lib/suid/args_linux_test.go b/services/device/internal/suid/args_linux_test.go
similarity index 100%
rename from lib/suid/args_linux_test.go
rename to services/device/internal/suid/args_linux_test.go
diff --git a/lib/suid/args_test.go b/services/device/internal/suid/args_test.go
similarity index 76%
rename from lib/suid/args_test.go
rename to services/device/internal/suid/args_test.go
index 5476a06..092c1ab 100644
--- a/lib/suid/args_test.go
+++ b/services/device/internal/suid/args_test.go
@@ -41,6 +41,8 @@
 				envv:      []string{"A=B"},
 				dryrun:    false,
 				remove:    false,
+				kill:      false,
+				killPids:  nil,
 			},
 		},
 
@@ -59,8 +61,11 @@
 				envv:      []string{"A=B"},
 				dryrun:    false,
 				remove:    false,
+				kill:      false,
+				killPids:  nil,
 			},
 		},
+
 		{
 			[]string{"setuidhelper", "--username", testUserName},
 			[]string{"A=B"},
@@ -82,13 +87,47 @@
 				envv:      nil,
 				dryrun:    false,
 				remove:    true,
+				kill:      false,
+				killPids:  nil,
 			},
 		},
+
 		{
-			[]string{"setuidhelper", "--username", testUserName},
+			[]string{"setuidhelper", "--kill", "235", "451"},
 			[]string{"A=B"},
-			errUIDTooLow.ID,
-			WorkParameters{},
+			"",
+			WorkParameters{
+				uid:       0,
+				gid:       0,
+				workspace: "",
+				logDir:    "",
+				argv0:     "",
+				argv:      nil,
+				envv:      nil,
+				dryrun:    false,
+				remove:    false,
+				kill:      true,
+				killPids:  []int{235, 451},
+			},
+		},
+
+		{
+			[]string{"setuidhelper", "--kill", "235", "451oops"},
+			[]string{"A=B"},
+			errAtoiFailed.ID,
+			WorkParameters{
+				uid:       0,
+				gid:       0,
+				workspace: "",
+				logDir:    "",
+				argv0:     "",
+				argv:      nil,
+				envv:      nil,
+				dryrun:    false,
+				remove:    false,
+				kill:      true,
+				killPids:  nil,
+			},
 		},
 
 		{
@@ -106,6 +145,8 @@
 				envv:      []string{"A=B"},
 				dryrun:    true,
 				remove:    false,
+				kill:      false,
+				killPids:  nil,
 			},
 		},
 	}
diff --git a/lib/suid/constants.go b/services/device/internal/suid/constants.go
similarity index 100%
rename from lib/suid/constants.go
rename to services/device/internal/suid/constants.go
diff --git a/lib/suid/run.go b/services/device/internal/suid/run.go
similarity index 91%
rename from lib/suid/run.go
rename to services/device/internal/suid/run.go
index bedc968..3814353 100644
--- a/lib/suid/run.go
+++ b/services/device/internal/suid/run.go
@@ -18,6 +18,10 @@
 		return work.Remove()
 	}
 
+	if work.kill {
+		return work.Kill()
+	}
+
 	if err := work.Chown(); err != nil {
 		return err
 	}
diff --git a/lib/suid/system.go b/services/device/internal/suid/system.go
similarity index 84%
rename from lib/suid/system.go
rename to services/device/internal/suid/system.go
index de37d54..6aad84b 100644
--- a/lib/suid/system.go
+++ b/services/device/internal/suid/system.go
@@ -21,6 +21,8 @@
 	errGetwdFailed        = verror.Register(pkgPath+".errGetwdFailed", verror.NoRetry, "{1:}{2:} os.Getwd failed{:_}")
 	errStartProcessFailed = verror.Register(pkgPath+".errStartProcessFailed", verror.NoRetry, "{1:}{2:} syscall.StartProcess({3}) failed{:_}")
 	errRemoveAllFailed    = verror.Register(pkgPath+".errRemoveAllFailed", verror.NoRetry, "{1:}{2:} os.RemoveAll({3}) failed{:_}")
+	errFindProcessFailed  = verror.Register(pkgPath+".errFindProcessFailed", verror.NoRetry, "{1:}{2:} os.FindProcess({3}) failed{:_}")
+	errKillFailed         = verror.Register(pkgPath+".errKillFailed", verror.NoRetry, "{1:}{2:} os.Process.Kill({3}) failed{:_}")
 )
 
 // Chown is only availabe on UNIX platforms so this file has a build
@@ -106,3 +108,17 @@
 	}
 	return nil
 }
+
+func (hw *WorkParameters) Kill() error {
+	for _, pid := range hw.killPids {
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			return verror.New(errFindProcessFailed, nil, pid, err)
+		}
+
+		if err = proc.Kill(); err != nil {
+			return verror.New(errKillFailed, nil, pid, err)
+		}
+	}
+	return nil
+}
diff --git a/lib/suid/system_test.go b/services/device/internal/suid/system_test.go
similarity index 100%
rename from lib/suid/system_test.go
rename to services/device/internal/suid/system_test.go
diff --git a/lib/sysinit/init_darwin.go b/services/device/internal/sysinit/init_darwin.go
similarity index 100%
rename from lib/sysinit/init_darwin.go
rename to services/device/internal/sysinit/init_darwin.go
diff --git a/lib/sysinit/init_linux.go b/services/device/internal/sysinit/init_linux.go
similarity index 100%
rename from lib/sysinit/init_linux.go
rename to services/device/internal/sysinit/init_linux.go
diff --git a/lib/sysinit/linux_test.go b/services/device/internal/sysinit/linux_test.go
similarity index 100%
rename from lib/sysinit/linux_test.go
rename to services/device/internal/sysinit/linux_test.go
diff --git a/lib/sysinit/service_description.go b/services/device/internal/sysinit/service_description.go
similarity index 97%
rename from lib/sysinit/service_description.go
rename to services/device/internal/sysinit/service_description.go
index d19f072..42a7f27 100644
--- a/lib/sysinit/service_description.go
+++ b/services/device/internal/sysinit/service_description.go
@@ -14,7 +14,7 @@
 	"v.io/v23/verror"
 )
 
-const pkgPath = "v.io/x/ref/lib/sysinit"
+const pkgPath = "v.io/x/ref/services/device/internal/sysinit"
 
 var (
 	errMarshalFailed   = verror.Register(pkgPath+".errMarshalFailed", verror.NoRetry, "{1:}{2:} Marshal({3}) failed{:_}")
diff --git a/lib/sysinit/sysinit.go b/services/device/internal/sysinit/sysinit.go
similarity index 100%
rename from lib/sysinit/sysinit.go
rename to services/device/internal/sysinit/sysinit.go
diff --git a/services/device/mgmt_v23_test.go b/services/device/mgmt_v23_test.go
index 7fc2c4f..cead99a 100644
--- a/services/device/mgmt_v23_test.go
+++ b/services/device/mgmt_v23_test.go
@@ -177,7 +177,7 @@
 
 	// Verify the device's default blessing is as expected.
 	inv := debugBin.Start("stats", "read", mtName+"/devmgr/__debug/stats/security/principal/*/blessingstore")
-	inv.ExpectRE(".*Default blessings: root/alice/myworkstation$", -1)
+	inv.ExpectSetEventuallyRE(".*Default Blessings[ ]+root/alice/myworkstation$")
 
 	// Get the device's profile, which should be set to non-empty string
 	inv = deviceBin.Start("describe", mtName+"/devmgr/device")
@@ -268,7 +268,7 @@
 
 	// Verify the app's default blessing.
 	inv = debugBin.Start("stats", "read", instanceName+"/stats/security/principal/*/blessingstore")
-	inv.ExpectRE(".*Default blessings: root/alice/myapp$", -1)
+	inv.ExpectSetEventuallyRE(".*Default Blessings[ ]+root/alice/myapp$")
 
 	// Stop the instance
 	deviceBin.Run("stop", instanceName)
diff --git a/services/device/suidhelper/main.go b/services/device/suidhelper/main.go
index 92fc1c9..bde6625 100644
--- a/services/device/suidhelper/main.go
+++ b/services/device/suidhelper/main.go
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Command suidhelper runs the provided command as the specified user identity.
+// It should be installed setuid root.
 package main
 
-// suidhelper should be installed setuid root. Having done this, it will
-// run the provided command as the specified user identity.
 // suidhelper deliberately attempts to be as simple as possible to
 // simplify reviewing it for security concerns.
 
@@ -14,7 +14,7 @@
 	"fmt"
 	"os"
 
-	"v.io/x/ref/lib/suid"
+	"v.io/x/ref/services/device/internal/suid"
 )
 
 func main() {
diff --git a/services/discharger/discharger.vdl b/services/discharger/discharger.vdl
index 7aed262..c04ae3a 100644
--- a/services/discharger/discharger.vdl
+++ b/services/discharger/discharger.vdl
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package discharger defines an interface for obtaining discharges for
+// third-party caveats.
 package discharger
 
 import "v.io/v23/security"
diff --git a/services/discharger/discharger.vdl.go b/services/discharger/discharger.vdl.go
index 1024842..0729ecc 100644
--- a/services/discharger/discharger.vdl.go
+++ b/services/discharger/discharger.vdl.go
@@ -5,6 +5,8 @@
 // This file was auto-generated by the vanadium vdl tool.
 // Source: discharger.vdl
 
+// Package discharger defines an interface for obtaining discharges for
+// third-party caveats.
 package discharger
 
 import (
diff --git a/services/groups/groupsd/main.go b/services/groups/groupsd/main.go
index 39222de..ab59f78 100644
--- a/services/groups/groupsd/main.go
+++ b/services/groups/groupsd/main.go
@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Daemon groupsd manages groups for access control.
+// Daemon groupsd implements the v.io/v23/services/groups interfaces for
+// managing access control groups.
 package main
 
 // Example invocation:
diff --git a/services/identity/identity.vdl b/services/identity/identity.vdl
index f761fad..5b265b5 100644
--- a/services/identity/identity.vdl
+++ b/services/identity/identity.vdl
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package identity defines services for identity providers in the vanadium ecosystem.
+// Package identity defines interfaces for Vanadium identity providers.
 package identity
 
 import "v.io/v23/security"
diff --git a/services/identity/identity.vdl.go b/services/identity/identity.vdl.go
index 08a329c..f8c2b27 100644
--- a/services/identity/identity.vdl.go
+++ b/services/identity/identity.vdl.go
@@ -5,7 +5,7 @@
 // This file was auto-generated by the vanadium vdl tool.
 // Source: identity.vdl
 
-// Package identity defines services for identity providers in the vanadium ecosystem.
+// Package identity defines interfaces for Vanadium identity providers.
 package identity
 
 import (
diff --git a/services/identity/identityd/main.go b/services/identity/identityd/main.go
index 5b9f07c..1c57547 100644
--- a/services/identity/identityd/main.go
+++ b/services/identity/identityd/main.go
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// HTTP server that uses OAuth to create security.Blessings objects.
+// Daemon identityd is an HTTP server that uses OAuth to create
+// security.Blessings objects.
+//
 // For more information on our setup of the identity server see:
 // https://docs.google.com/document/d/1ebQ1sQn95cFu8yQM36rpJ8mQvsU29aa1o03ADhi52BM
 package main
diff --git a/services/identity/identitylib/test_identityd.go b/services/identity/identitylib/test_identityd.go
index 6287264..53c8587 100644
--- a/services/identity/identitylib/test_identityd.go
+++ b/services/identity/identitylib/test_identityd.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package identitylib implements a test identityd service under the
+// v.io/x/ref/test/modules framework.
 package identitylib
 
 import (
diff --git a/services/discharger/dischargerlib/discharger.go b/services/identity/internal/dischargerlib/discharger.go
similarity index 100%
rename from services/discharger/dischargerlib/discharger.go
rename to services/identity/internal/dischargerlib/discharger.go
diff --git a/services/identity/internal/revocation/revocation_test.go b/services/identity/internal/revocation/revocation_test.go
index ce54d9b..5755471d 100644
--- a/services/identity/internal/revocation/revocation_test.go
+++ b/services/identity/internal/revocation/revocation_test.go
@@ -9,7 +9,7 @@
 
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/discharger"
-	"v.io/x/ref/services/discharger/dischargerlib"
+	"v.io/x/ref/services/identity/internal/dischargerlib"
 	"v.io/x/ref/test"
 
 	"v.io/v23"
diff --git a/services/identity/internal/server/identityd.go b/services/identity/internal/server/identityd.go
index 6797c39..a3aaff3 100644
--- a/services/identity/internal/server/identityd.go
+++ b/services/identity/internal/server/identityd.go
@@ -27,10 +27,10 @@
 	"v.io/x/ref/lib/security/audit"
 	"v.io/x/ref/lib/signals"
 	"v.io/x/ref/services/discharger"
-	"v.io/x/ref/services/discharger/dischargerlib"
 	"v.io/x/ref/services/identity/internal/auditor"
 	"v.io/x/ref/services/identity/internal/blesser"
 	"v.io/x/ref/services/identity/internal/caveats"
+	"v.io/x/ref/services/identity/internal/dischargerlib"
 	"v.io/x/ref/services/identity/internal/handlers"
 	"v.io/x/ref/services/identity/internal/oauth"
 	"v.io/x/ref/services/identity/internal/revocation"
diff --git a/services/binary/binarylib/acl_test.go b/services/internal/binarylib/acl_test.go
similarity index 99%
rename from services/binary/binarylib/acl_test.go
rename to services/internal/binarylib/acl_test.go
index 8dbf0ba..27be6a5 100644
--- a/services/binary/binarylib/acl_test.go
+++ b/services/internal/binarylib/acl_test.go
@@ -22,7 +22,7 @@
 	"v.io/x/lib/vlog"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/lib/signals"
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
diff --git a/services/binary/binarylib/client.go b/services/internal/binarylib/client.go
similarity index 100%
rename from services/binary/binarylib/client.go
rename to services/internal/binarylib/client.go
diff --git a/services/binary/binarylib/client_test.go b/services/internal/binarylib/client_test.go
similarity index 100%
rename from services/binary/binarylib/client_test.go
rename to services/internal/binarylib/client_test.go
diff --git a/services/binary/binarylib/dispatcher.go b/services/internal/binarylib/dispatcher.go
similarity index 100%
rename from services/binary/binarylib/dispatcher.go
rename to services/internal/binarylib/dispatcher.go
diff --git a/services/binary/binarylib/fs_utils.go b/services/internal/binarylib/fs_utils.go
similarity index 100%
rename from services/binary/binarylib/fs_utils.go
rename to services/internal/binarylib/fs_utils.go
diff --git a/services/binary/binarylib/http.go b/services/internal/binarylib/http.go
similarity index 96%
rename from services/binary/binarylib/http.go
rename to services/internal/binarylib/http.go
index dec5e34..7d53bf3 100644
--- a/services/binary/binarylib/http.go
+++ b/services/internal/binarylib/http.go
@@ -13,7 +13,7 @@
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
-	"v.io/x/ref/services/binary/internal/multipart"
+	"v.io/x/ref/services/internal/multipart"
 )
 
 // NewHTTPRoot returns an implementation of http.FileSystem that can be used
diff --git a/services/binary/binarylib/http_test.go b/services/internal/binarylib/http_test.go
similarity index 98%
rename from services/binary/binarylib/http_test.go
rename to services/internal/binarylib/http_test.go
index 7ce42dc..60968c7 100644
--- a/services/binary/binarylib/http_test.go
+++ b/services/internal/binarylib/http_test.go
@@ -16,7 +16,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/services/repository"
 
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
 )
diff --git a/services/binary/binarylib/impl_test.go b/services/internal/binarylib/impl_test.go
similarity index 99%
rename from services/binary/binarylib/impl_test.go
rename to services/internal/binarylib/impl_test.go
index d8d5a17..9d72fae 100644
--- a/services/binary/binarylib/impl_test.go
+++ b/services/internal/binarylib/impl_test.go
@@ -22,7 +22,7 @@
 	"v.io/x/lib/vlog"
 
 	_ "v.io/x/ref/profiles/static"
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/services/internal/servicetest"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
diff --git a/services/binary/binarylib/service.go b/services/internal/binarylib/service.go
similarity index 99%
rename from services/binary/binarylib/service.go
rename to services/internal/binarylib/service.go
index 5a83d94..6fe0418 100644
--- a/services/binary/binarylib/service.go
+++ b/services/internal/binarylib/service.go
@@ -63,7 +63,7 @@
 	aclstore *acls.PathStore
 }
 
-const pkgPath = "v.io/x/ref/services/binary/binarylib"
+const pkgPath = "v.io/x/ref/services/internal/binarylib"
 
 var (
 	ErrInProgress      = verror.Register(pkgPath+".errInProgress", verror.NoRetry, "{1:}{2:} identical upload already in progress{:_}")
diff --git a/services/binary/binarylib/setup.go b/services/internal/binarylib/setup.go
similarity index 100%
rename from services/binary/binarylib/setup.go
rename to services/internal/binarylib/setup.go
diff --git a/services/binary/binarylib/state.go b/services/internal/binarylib/state.go
similarity index 100%
rename from services/binary/binarylib/state.go
rename to services/internal/binarylib/state.go
diff --git a/services/binary/binarylib/util_test.go b/services/internal/binarylib/util_test.go
similarity index 98%
rename from services/binary/binarylib/util_test.go
rename to services/internal/binarylib/util_test.go
index 2be5369..2038f46 100644
--- a/services/binary/binarylib/util_test.go
+++ b/services/internal/binarylib/util_test.go
@@ -13,7 +13,7 @@
 	"v.io/v23/context"
 	"v.io/v23/services/repository"
 
-	"v.io/x/ref/services/binary/binarylib"
+	"v.io/x/ref/services/internal/binarylib"
 	"v.io/x/ref/test/testutil"
 )
 
diff --git a/services/binary/binarylib/v23_test.go b/services/internal/binarylib/v23_test.go
similarity index 100%
rename from services/binary/binarylib/v23_test.go
rename to services/internal/binarylib/v23_test.go
diff --git a/services/logreader/logreaderlib/logfile.go b/services/internal/logreaderlib/logfile.go
similarity index 98%
rename from services/logreader/logreaderlib/logfile.go
rename to services/internal/logreaderlib/logfile.go
index 26f89a6..77d22e3 100644
--- a/services/logreader/logreaderlib/logfile.go
+++ b/services/internal/logreaderlib/logfile.go
@@ -21,7 +21,7 @@
 	"v.io/x/lib/vlog"
 )
 
-const pkgPath = "v.io/x/ref/services/logreader/logreaderlib"
+const pkgPath = "v.io/x/ref/services/internal/logreaderlib"
 
 var (
 	errOperationFailed = verror.Register(pkgPath+".errOperationFailed", verror.NoRetry, "{1:}{2:} operation failed{:_}")
diff --git a/services/logreader/logreaderlib/logfile_test.go b/services/internal/logreaderlib/logfile_test.go
similarity index 98%
rename from services/logreader/logreaderlib/logfile_test.go
rename to services/internal/logreaderlib/logfile_test.go
index e94b4d2..6ed1e14 100644
--- a/services/logreader/logreaderlib/logfile_test.go
+++ b/services/internal/logreaderlib/logfile_test.go
@@ -17,10 +17,10 @@
 	"v.io/v23/security"
 	"v.io/v23/services/logreader"
 	"v.io/v23/verror"
+	"v.io/x/ref/services/internal/logreaderlib"
+	"v.io/x/ref/test"
 
 	_ "v.io/x/ref/profiles"
-	"v.io/x/ref/services/logreader/logreaderlib"
-	"v.io/x/ref/test"
 )
 
 //go:generate v23 test generate
diff --git a/services/logreader/logreaderlib/reader.go b/services/internal/logreaderlib/reader.go
similarity index 100%
rename from services/logreader/logreaderlib/reader.go
rename to services/internal/logreaderlib/reader.go
diff --git a/services/logreader/logreaderlib/reader_test.go b/services/internal/logreaderlib/reader_test.go
similarity index 100%
rename from services/logreader/logreaderlib/reader_test.go
rename to services/internal/logreaderlib/reader_test.go
diff --git a/services/logreader/logreaderlib/v23_internal_test.go b/services/internal/logreaderlib/v23_internal_test.go
similarity index 100%
rename from services/logreader/logreaderlib/v23_internal_test.go
rename to services/internal/logreaderlib/v23_internal_test.go
diff --git a/services/binary/internal/multipart/multipart.go b/services/internal/multipart/multipart.go
similarity index 96%
rename from services/binary/internal/multipart/multipart.go
rename to services/internal/multipart/multipart.go
index 585683c..af7f986 100644
--- a/services/binary/internal/multipart/multipart.go
+++ b/services/internal/multipart/multipart.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// multipart provides an implementation for http.File that acts as one logical
-// file backed by several physical files (the 'parts').
+// Package multipart implements an http.File that acts as one logical file
+// backed by several physical files (the 'parts').
 package multipart
 
 import (
diff --git a/services/binary/internal/multipart/multipart_test.go b/services/internal/multipart/multipart_test.go
similarity index 98%
rename from services/binary/internal/multipart/multipart_test.go
rename to services/internal/multipart/multipart_test.go
index 7acab57..d0995d2 100644
--- a/services/binary/internal/multipart/multipart_test.go
+++ b/services/internal/multipart/multipart_test.go
@@ -14,7 +14,7 @@
 	"strings"
 	"testing"
 
-	"v.io/x/ref/services/binary/internal/multipart"
+	"v.io/x/ref/services/internal/multipart"
 )
 
 func read(t *testing.T, m http.File, thisMuch int) string {
diff --git a/services/pprof/pproflib/proxy.go b/services/internal/pproflib/proxy.go
similarity index 100%
rename from services/pprof/pproflib/proxy.go
rename to services/internal/pproflib/proxy.go
diff --git a/services/pprof/pproflib/proxy_test.go b/services/internal/pproflib/proxy_test.go
similarity index 97%
rename from services/pprof/pproflib/proxy_test.go
rename to services/internal/pproflib/proxy_test.go
index 34afb6f..b44a062 100644
--- a/services/pprof/pproflib/proxy_test.go
+++ b/services/internal/pproflib/proxy_test.go
@@ -12,10 +12,10 @@
 
 	"v.io/v23"
 	"v.io/v23/security"
+	"v.io/x/ref/services/internal/pproflib"
+	"v.io/x/ref/test"
 
 	_ "v.io/x/ref/profiles"
-	"v.io/x/ref/services/pprof/pproflib"
-	"v.io/x/ref/test"
 )
 
 //go:generate v23 test generate
diff --git a/services/pprof/pproflib/server.go b/services/internal/pproflib/server.go
similarity index 97%
rename from services/pprof/pproflib/server.go
rename to services/internal/pproflib/server.go
index 57a143a..f8e6642 100644
--- a/services/pprof/pproflib/server.go
+++ b/services/internal/pproflib/server.go
@@ -15,7 +15,7 @@
 	"v.io/v23/verror"
 )
 
-const pkgPath = "v.io/x/ref/services/pprof/pproflib"
+const pkgPath = "v.io/x/ref/services/internal/pproflib"
 
 // Errors
 var (
diff --git a/services/pprof/pproflib/v23_internal_test.go b/services/internal/pproflib/v23_internal_test.go
similarity index 100%
rename from services/pprof/pproflib/v23_internal_test.go
rename to services/internal/pproflib/v23_internal_test.go
diff --git a/services/stats/statslib/stats.go b/services/internal/statslib/stats.go
similarity index 98%
rename from services/stats/statslib/stats.go
rename to services/internal/statslib/stats.go
index 76bf03e..0433763 100644
--- a/services/stats/statslib/stats.go
+++ b/services/internal/statslib/stats.go
@@ -26,7 +26,7 @@
 	watchFreq time.Duration
 }
 
-const pkgPath = "v.io/x/ref/services/stats/statslib"
+const pkgPath = "v.io/x/ref/services/internal/statslib"
 
 var (
 	errOperationFailed = verror.Register(pkgPath+".errOperationFailed", verror.NoRetry, "{1:}{2:} operation failed{:_}")
diff --git a/services/stats/statslib/stats_test.go b/services/internal/statslib/stats_test.go
similarity index 98%
rename from services/stats/statslib/stats_test.go
rename to services/internal/statslib/stats_test.go
index eae18e0..15adbf3 100644
--- a/services/stats/statslib/stats_test.go
+++ b/services/internal/statslib/stats_test.go
@@ -20,11 +20,12 @@
 
 	libstats "v.io/x/ref/lib/stats"
 	"v.io/x/ref/lib/stats/histogram"
-	_ "v.io/x/ref/profiles"
+	"v.io/x/ref/services/internal/statslib"
 	s_stats "v.io/x/ref/services/stats"
-	"v.io/x/ref/services/stats/statslib"
 	"v.io/x/ref/test"
 	"v.io/x/ref/test/testutil"
+
+	_ "v.io/x/ref/profiles"
 )
 
 //go:generate v23 test generate
diff --git a/services/stats/statslib/v23_internal_test.go b/services/internal/statslib/v23_internal_test.go
similarity index 100%
rename from services/stats/statslib/v23_internal_test.go
rename to services/internal/statslib/v23_internal_test.go
diff --git a/services/vtrace/vtracelib/v23_internal_test.go b/services/internal/vtracelib/v23_internal_test.go
similarity index 100%
rename from services/vtrace/vtracelib/v23_internal_test.go
rename to services/internal/vtracelib/v23_internal_test.go
diff --git a/services/vtrace/vtracelib/vtrace.go b/services/internal/vtracelib/vtrace.go
similarity index 100%
rename from services/vtrace/vtracelib/vtrace.go
rename to services/internal/vtracelib/vtrace.go
diff --git a/services/vtrace/vtracelib/vtrace_test.go b/services/internal/vtracelib/vtrace_test.go
similarity index 97%
rename from services/vtrace/vtracelib/vtrace_test.go
rename to services/internal/vtracelib/vtrace_test.go
index d509993..dd159b0 100644
--- a/services/vtrace/vtracelib/vtrace_test.go
+++ b/services/internal/vtracelib/vtrace_test.go
@@ -11,10 +11,10 @@
 	"v.io/v23"
 	s_vtrace "v.io/v23/services/vtrace"
 	"v.io/v23/vtrace"
+	"v.io/x/ref/services/internal/vtracelib"
+	"v.io/x/ref/test"
 
 	_ "v.io/x/ref/profiles"
-	"v.io/x/ref/services/vtrace/vtracelib"
-	"v.io/x/ref/test"
 )
 
 //go:generate v23 test generate
diff --git a/services/mounttable/mounttabled/mounttable.go b/services/mounttable/mounttabled/mounttable.go
index d2afd5a..7dc5759 100644
--- a/services/mounttable/mounttabled/mounttable.go
+++ b/services/mounttable/mounttabled/mounttable.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// mounttabled is a mount table daemon.
+// Daemon mounttabled implements the v.io/v23/services/mounttable interfaces.
 package main
 
 import (
diff --git a/services/mounttable/mounttablelib/mounttable.go b/services/mounttable/mounttablelib/mounttable.go
index 6e1c19d..2d8a28a 100644
--- a/services/mounttable/mounttablelib/mounttable.go
+++ b/services/mounttable/mounttablelib/mounttable.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package mounttablelib implements utilities for mounttable implementations.
 package mounttablelib
 
 import (
diff --git a/services/profile/profile.vdl b/services/profile/profile.vdl
index 5b783b7..c2b91a5 100644
--- a/services/profile/profile.vdl
+++ b/services/profile/profile.vdl
@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package profile contains implementation and internal interfaces and
-// types used by the implementation of Vanadium profiles.
+// Package profile defines types for the implementation of Vanadium profiles.
 package profile
 
 import "v.io/v23/services/build"
diff --git a/services/profile/profile.vdl.go b/services/profile/profile.vdl.go
index def9418..f5e27f9 100644
--- a/services/profile/profile.vdl.go
+++ b/services/profile/profile.vdl.go
@@ -5,8 +5,7 @@
 // This file was auto-generated by the vanadium vdl tool.
 // Source: profile.vdl
 
-// Package profile contains implementation and internal interfaces and
-// types used by the implementation of Vanadium profiles.
+// Package profile defines types for the implementation of Vanadium profiles.
 package profile
 
 import (
diff --git a/services/profile/profile/doc.go b/services/profile/profile/doc.go
index caa2d02..0b5995c 100644
--- a/services/profile/profile/doc.go
+++ b/services/profile/profile/doc.go
@@ -6,7 +6,7 @@
 // DO NOT UPDATE MANUALLY
 
 /*
-The profile tool facilitates interaction with the vanadium profile repository.
+Command profile manages the Vanadium profile repository.
 
 Usage:
    profile <command>
@@ -39,7 +39,7 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/ns.dev.v.io:8101]
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
    local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
diff --git a/services/profile/profile/impl.go b/services/profile/profile/impl.go
index 03bc0ef..1b6bbc0 100644
--- a/services/profile/profile/impl.go
+++ b/services/profile/profile/impl.go
@@ -10,6 +10,7 @@
 
 	"v.io/v23/context"
 	"v.io/v23/services/build"
+
 	"v.io/x/lib/cmdline"
 	"v.io/x/ref/services/profile"
 	"v.io/x/ref/services/repository"
@@ -108,12 +109,12 @@
 
 	// TODO(rthellend): Read an actual specification from a file.
 	spec := profile.Specification{
-		Arch:        build.AMD64,
+		Arch:        build.ArchitectureAmd64,
 		Description: "Example profile to test the profile manager implementation.",
-		Format:      build.ELF,
+		Format:      build.FormatElf,
 		Libraries:   map[profile.Library]struct{}{profile.Library{Name: "foo", MajorVersion: "1", MinorVersion: "0"}: struct{}{}},
 		Label:       "example",
-		Os:          build.Linux,
+		Os:          build.OperatingSystemLinux,
 	}
 	ctx, cancel := context.WithTimeout(gctx, time.Minute)
 	defer cancel()
@@ -151,9 +152,9 @@
 func root() *cmdline.Command {
 	return &cmdline.Command{
 		Name:  "profile",
-		Short: "Tool for interacting with the vanadium profile repository",
+		Short: "manages the Vanadium profile repository",
 		Long: `
-The profile tool facilitates interaction with the vanadium profile repository.
+Command profile manages the Vanadium profile repository.
 `,
 		Children: []*cmdline.Command{cmdLabel, cmdDescription, cmdSpecification, cmdPut, cmdRemove},
 	}
diff --git a/services/profile/profile/impl_test.go b/services/profile/profile/impl_test.go
index 04a47b2..82f358a 100644
--- a/services/profile/profile/impl_test.go
+++ b/services/profile/profile/impl_test.go
@@ -16,8 +16,8 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/services/build"
-	"v.io/x/lib/vlog"
 
+	"v.io/x/lib/vlog"
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/services/profile"
 	"v.io/x/ref/services/repository"
@@ -27,12 +27,12 @@
 var (
 	// spec is an example profile specification used throughout the test.
 	spec = profile.Specification{
-		Arch:        build.AMD64,
+		Arch:        build.ArchitectureAmd64,
 		Description: "Example profile to test the profile repository implementation.",
-		Format:      build.ELF,
+		Format:      build.FormatElf,
 		Libraries:   map[profile.Library]struct{}{profile.Library{Name: "foo", MajorVersion: "1", MinorVersion: "0"}: struct{}{}},
 		Label:       "example",
-		Os:          build.Linux,
+		Os:          build.OperatingSystemLinux,
 	}
 )
 
diff --git a/services/profile/profiled/impl_test.go b/services/profile/profiled/impl_test.go
index 4903e8c..a981873 100644
--- a/services/profile/profiled/impl_test.go
+++ b/services/profile/profiled/impl_test.go
@@ -22,12 +22,12 @@
 var (
 	// spec is an example profile specification used throughout the test.
 	spec = profile.Specification{
-		Arch:        build.AMD64,
+		Arch:        build.ArchitectureAmd64,
 		Description: "Example profile to test the profile repository implementation.",
-		Format:      build.ELF,
+		Format:      build.FormatElf,
 		Libraries:   map[profile.Library]struct{}{profile.Library{Name: "foo", MajorVersion: "1", MinorVersion: "0"}: struct{}{}},
 		Label:       "example",
-		Os:          build.Linux,
+		Os:          build.OperatingSystemLinux,
 	}
 )
 
diff --git a/services/profile/profiled/main.go b/services/profile/profiled/main.go
index ab1ab3d..381edec 100644
--- a/services/profile/profiled/main.go
+++ b/services/profile/profiled/main.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon profiled implements the v.io/x/ref/services/repository.Profile
+// interface.
 package main
 
 import (
diff --git a/services/profile/profiled/profiled_v23_test.go b/services/profile/profiled/profiled_v23_test.go
index 872d547..527ba7f 100644
--- a/services/profile/profiled/profiled_v23_test.go
+++ b/services/profile/profiled/profiled_v23_test.go
@@ -5,10 +5,12 @@
 package main_test
 
 import (
+	"fmt"
 	"os"
 	"strings"
 
 	"v.io/v23/naming"
+	"v.io/v23/services/build"
 	"v.io/x/ref/test/v23tests"
 )
 
@@ -79,7 +81,7 @@
 	// Retrieve the profile specification and check it matches the
 	// expected specification.
 	profileSpec := profileCommandOutput(i, clientBin, false, "specification", profileRepoName, profile)
-	if got, want := profileSpec, `profile.Specification{Label:"example", Description:"Example profile to test the profile manager implementation.", Arch:"amd64", Os:"linux", Format:"ELF", Libraries:map[profile.Library]struct {}{profile.Library{Name:"foo", MajorVersion:"1", MinorVersion:"0"}:struct {}{}}}`; got != want {
+	if got, want := profileSpec, fmt.Sprintf(`profile.Specification{Label:"example", Description:"Example profile to test the profile manager implementation.", Arch:%d, Os:%d, Format:%d, Libraries:map[profile.Library]struct {}{profile.Library{Name:"foo", MajorVersion:"1", MinorVersion:"0"}:struct {}{}}}`, build.ArchitectureAmd64, build.OperatingSystemLinux, build.FormatElf); got != want {
 		i.Fatalf("unexpected output: got %v, want %v", got, want)
 	}
 
diff --git a/services/proxy/proxyd/main.go b/services/proxy/proxyd/main.go
index 57e9377..c454b68 100644
--- a/services/proxy/proxyd/main.go
+++ b/services/proxy/proxyd/main.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// proxyd is a daemon that listens for connections from vanadium services
-// (typically behind NATs) and proxies these services to the outside world.
+// Daemon proxyd listens for connections from Vanadium services (typically
+// behind NATs) and proxies these services to the outside world.
 package main
 
 import (
diff --git a/services/repository/repository.vdl b/services/repository/repository.vdl
index fd4961a..0e4cf1b 100644
--- a/services/repository/repository.vdl
+++ b/services/repository/repository.vdl
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package repository contains implementation of the interface for
-// storing and serving various vanadium management objects.
+// Package repository augments the v.io/v23/services/repository interfaces with
+// implementation-specific configuration methods.
 package repository
 
 import (
diff --git a/services/repository/repository.vdl.go b/services/repository/repository.vdl.go
index 806c856..55d0546 100644
--- a/services/repository/repository.vdl.go
+++ b/services/repository/repository.vdl.go
@@ -5,8 +5,8 @@
 // This file was auto-generated by the vanadium vdl tool.
 // Source: repository.vdl
 
-// Package repository contains implementation of the interface for
-// storing and serving various vanadium management objects.
+// Package repository augments the v.io/v23/services/repository interfaces with
+// implementation-specific configuration methods.
 package repository
 
 import (
diff --git a/services/role/role.vdl b/services/role/role.vdl
index 454d0dc..ec5897f 100644
--- a/services/role/role.vdl
+++ b/services/role/role.vdl
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package role defines an interface for requesting blessings from a role
+// account server.
 package role
 
 import "v.io/v23/security"
diff --git a/services/role/role.vdl.go b/services/role/role.vdl.go
index 1b4ab83..a7f0ee1 100644
--- a/services/role/role.vdl.go
+++ b/services/role/role.vdl.go
@@ -5,6 +5,8 @@
 // This file was auto-generated by the vanadium vdl tool.
 // Source: role.vdl
 
+// Package role defines an interface for requesting blessings from a role
+// account server.
 package role
 
 import (
diff --git a/services/role/roled/main.go b/services/role/roled/main.go
index 655156c..5e192ad 100644
--- a/services/role/roled/main.go
+++ b/services/role/roled/main.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon roled implements the Role interface.
 package main
 
 import (
diff --git a/services/wspr/browsprd/main_nacl.go b/services/wspr/browsprd/main_nacl.go
index 7b4f7a3..a56e332 100644
--- a/services/wspr/browsprd/main_nacl.go
+++ b/services/wspr/browsprd/main_nacl.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon browsprd implements the wspr web socket proxy as a Native Client
+// executable, to be run as a Chrome extension.
 package main
 
 import (
diff --git a/services/wspr/internal/namespace/request_handler.go b/services/wspr/internal/namespace/request_handler.go
index 6112c90..862663c 100644
--- a/services/wspr/internal/namespace/request_handler.go
+++ b/services/wspr/internal/namespace/request_handler.go
@@ -34,14 +34,7 @@
 	stream := call.SendStream()
 
 	for mp := range ch {
-		var reply naming.GlobReply
-		switch v := mp.(type) {
-		case *naming.GlobError:
-			reply = naming.GlobReplyError{*v}
-		case *naming.MountEntry:
-			reply = naming.GlobReplyEntry{*v}
-		}
-		if err = stream.Send(reply); err != nil {
+		if err = stream.Send(mp); err != nil {
 			return err
 		}
 	}
diff --git a/services/wspr/wsprd/main.go b/services/wspr/wsprd/main.go
index bd2c1ea..c5e7068 100644
--- a/services/wspr/wsprd/main.go
+++ b/services/wspr/wsprd/main.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Daemon wsprd implements the wspr web socket proxy as a stand-alone server.
 package main
 
 import (
diff --git a/services/wspr/wsprlib/wspr.go b/services/wspr/wsprlib/wspr.go
index 5b87b2b..d30e5f4 100644
--- a/services/wspr/wsprlib/wspr.go
+++ b/services/wspr/wsprlib/wspr.go
@@ -2,20 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// A simple WebSocket proxy (WSPR) that takes in a Vanadium RPC message, encoded in JSON
-// and stored in a WebSocket message, and sends it to the specified Veyron
-// endpoint.
-//
-// Input arguments must be provided as a JSON message in the following format:
-//
-// {
-//   "Address" : String, //EndPoint Address
-//   "Name" : String, //Service Name
-//   "Method"   : String, //Method Name
-//   "InArgs"     : { "ArgName1" : ArgVal1, "ArgName2" : ArgVal2, ... },
-//   "IsStreaming" : true/false
-// }
-//
+// Package wsprlib implements utilities for the wspr web socket proxy, which
+// converts between the Vanadium RPC protocol and a custom web socket based
+// protocol.
 package wsprlib
 
 import (
diff --git a/test/benchmark/stats.go b/test/benchmark/stats.go
index f600610..fab9321 100644
--- a/test/benchmark/stats.go
+++ b/test/benchmark/stats.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package benchmark implements utilities to augment the standard Go
+// testing.Benchmark functionality.
 package benchmark
 
 import (
diff --git a/test/doc.go b/test/doc.go
index f0fbcdb..cb84f2b 100644
--- a/test/doc.go
+++ b/test/doc.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package test provides initalization for unit and integration tests.
+// Package test implements initalization for unit and integration tests.
 //
 // Init configures logging, random number generators and other global state.
 // Typical usage in _test.go files:
diff --git a/test/expect/expect.go b/test/expect/expect.go
index 9ff7e9a..1bf3932 100644
--- a/test/expect/expect.go
+++ b/test/expect/expect.go
@@ -2,13 +2,12 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package expect provides support for testing the contents from a buffered
-// input stream. It supports literal and pattern based matching. It is
+// Package expect implements support for checking expectations against a
+// buffered input stream. It supports literal and pattern based matching. It is
 // line oriented; all of the methods (expect ReadAll) strip trailing newlines
-// from their return values. It places a timeout on all its operations.
-// It will generally be used to read from the stdout stream of subprocesses
-// in tests and other situations and to make 'assertions'
-// about what is to be read.
+// from their return values. It places a timeout on all its operations.  It will
+// generally be used to read from the stdout stream of subprocesses in tests and
+// other situations and to make 'assertions' about what is to be read.
 //
 // A Session type is used to store state, in particular error state, across
 // consecutive invocations of its method set. If a particular method call
diff --git a/test/modules/shell.go b/test/modules/shell.go
index 729c360..9d76804 100644
--- a/test/modules/shell.go
+++ b/test/modules/shell.go
@@ -2,13 +2,12 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package modules provides a mechanism for running commonly used services
-// as subprocesses and client functionality for accessing those services.
-// Such services and functions are collectively called 'commands' and
-// are managed by a 'Registry'. The Shell is analagous to the UNIX shell and
-// maintains a key, value store of environment variables and config settings
-// that are accessible to the commands that it hosts. Simple variable
-// expansion is supported.
+// Package modules implements a mechanism for running commonly used services as
+// subprocesses, and client functionality for accessing those services.  Such
+// services and functions are collectively called 'commands' and are managed by
+// a 'Registry'. The Shell is analagous to the UNIX shell and maintains a key,
+// value store of environment variables and config settings that are accessible
+// to the commands that it hosts. Simple variable expansion is supported.
 //
 // Four types of 'commands' may be invoked via a Shell.
 //
diff --git a/test/testutil/doc.go b/test/testutil/doc.go
index 781999c..3088a2f 100644
--- a/test/testutil/doc.go
+++ b/test/testutil/doc.go
@@ -2,6 +2,5 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package testutil provides a smorgasbord of utility functions and types for
-// unittests.
+// Package testutil implements utilities for unit and integration tests.
 package testutil
diff --git a/test/timekeeper/manual_time.go b/test/timekeeper/manual_time.go
index 490ad84..afc5b36 100644
--- a/test/timekeeper/manual_time.go
+++ b/test/timekeeper/manual_time.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+// Package timekeeper implements simulated time against the
+// v.io/x/ref/lib/timekeeper.TimeKeeper interface.
 package timekeeper
 
 import (
diff --git a/test/v23tests/doc.go b/test/v23tests/doc.go
index 9a6c5cd..dca518d 100644
--- a/test/v23tests/doc.go
+++ b/test/v23tests/doc.go
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package v23tests provides support for writing end-to-end style integration
-// tests. In particular, support is provided for building binaries, running
-// processes, making assertions about their output/state and ensuring that
-// no processes or files are left behind on exit. Since such tests are often
-// difficult to debug facilities are provided to help do so.
+// Package v23tests implements support for writing writing end-to-end
+// integration tests. In particular, support is provided for building binaries,
+// running processes, making assertions about their output/state and ensuring
+// that no processes or files are left behind on exit. Since such tests are
+// often difficult to debug facilities are provided to help do so.
 //
 // The preferred usage of this integration test framework is via the v23
 // tool which generates supporting code. The primary reason for doing so is
diff --git a/test/v23tests/v23tests.go b/test/v23tests/v23tests.go
index 9f78de7..3496356 100644
--- a/test/v23tests/v23tests.go
+++ b/test/v23tests/v23tests.go
@@ -8,6 +8,7 @@
 	"errors"
 	"fmt"
 	"io/ioutil"
+	"math/rand"
 	"os"
 	"os/exec"
 	"path"
@@ -18,9 +19,11 @@
 	"testing"
 	"time"
 
+	"v.io/x/lib/vlog"
+
 	"v.io/v23"
 	"v.io/v23/security"
-	"v.io/x/lib/vlog"
+
 	"v.io/x/ref/envvar"
 	"v.io/x/ref/services/agent"
 	"v.io/x/ref/test"
@@ -554,15 +557,33 @@
 // function.
 func buildPkg(binDir, pkg string) (bool, string, error) {
 	binFile := filepath.Join(binDir, path.Base(pkg))
+	vlog.Infof("buildPkg: %v .. %v", binDir, pkg)
 	if _, err := os.Stat(binFile); err != nil {
 		if !os.IsNotExist(err) {
 			return false, "", err
 		}
-		cmd := exec.Command("v23", "go", "build", "-o", binFile, pkg)
+		baseName := path.Base(binFile)
+		tmpdir, err := ioutil.TempDir(binDir, baseName+"-")
+		if err != nil {
+			return false, "", err
+		}
+		defer os.RemoveAll(tmpdir)
+		uniqueBinFile := filepath.Join(tmpdir, baseName)
+
+		cmd := exec.Command("v23", "go", "build", "-x", "-o", uniqueBinFile, pkg)
 		if output, err := cmd.CombinedOutput(); err != nil {
 			vlog.VI(1).Infof("\n%v:\n%v\n", strings.Join(cmd.Args, " "), string(output))
 			return false, "", err
 		}
+		if err := os.Rename(uniqueBinFile, binFile); err != nil {
+			// It seems that on some systems a rename may fail if another rename
+			// is in progress in the same directory. We back a random amount of time
+			// in the hope that a second attempt will succeed.
+			time.Sleep(time.Duration(rand.Int63n(1000)) * time.Millisecond)
+			if err := os.Rename(uniqueBinFile, binFile); err != nil {
+				return false, "", err
+			}
+		}
 		return false, binFile, nil
 	}
 	return true, binFile, nil