Merge "profiles/internal/naming/namespace|services/mounttable: Pass IsLeaf all the way"
diff --git a/cmd/application/doc.go b/cmd/application/doc.go
index b993352..eb474ad 100644
--- a/cmd/application/doc.go
+++ b/cmd/application/doc.go
@@ -36,6 +36,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/application/impl.go b/cmd/application/impl.go
index 1f32226..2f1b543 100644
--- a/cmd/application/impl.go
+++ b/cmd/application/impl.go
@@ -16,7 +16,7 @@
 	"time"
 
 	"v.io/v23/context"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/x/lib/cmdline"
 	"v.io/x/ref/services/mgmt/repository"
 )
diff --git a/cmd/application/impl_test.go b/cmd/application/impl_test.go
index 7943205..1cbcac5 100644
--- a/cmd/application/impl_test.go
+++ b/cmd/application/impl_test.go
@@ -17,7 +17,7 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/x/lib/vlog"
 
 	_ "v.io/x/ref/profiles"
diff --git a/cmd/binary/doc.go b/cmd/binary/doc.go
index f82f79d..5f85f8c 100644
--- a/cmd/binary/doc.go
+++ b/cmd/binary/doc.go
@@ -34,6 +34,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/binary/impl_test.go b/cmd/binary/impl_test.go
index 79fafa1..3fe3ca6 100644
--- a/cmd/binary/impl_test.go
+++ b/cmd/binary/impl_test.go
@@ -21,8 +21,8 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/repository"
 	"v.io/x/lib/vlog"
 
 	_ "v.io/x/ref/profiles"
diff --git a/cmd/build/doc.go b/cmd/build/doc.go
index 0980385..300e8aa 100644
--- a/cmd/build/doc.go
+++ b/cmd/build/doc.go
@@ -31,6 +31,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/build/impl.go b/cmd/build/impl.go
index ceae5d0..6bab8c1 100644
--- a/cmd/build/impl.go
+++ b/cmd/build/impl.go
@@ -15,7 +15,7 @@
 	"time"
 
 	"v.io/v23/context"
-	vbuild "v.io/v23/services/mgmt/build"
+	vbuild "v.io/v23/services/build"
 	"v.io/x/lib/cmdline"
 )
 
diff --git a/cmd/build/impl_test.go b/cmd/build/impl_test.go
index 9cc263b..180ac37 100644
--- a/cmd/build/impl_test.go
+++ b/cmd/build/impl_test.go
@@ -13,8 +13,8 @@
 	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/build"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
diff --git a/cmd/debug/debug_v23_test.go b/cmd/debug/debug_v23_test.go
index 592f7d3..ac3519b 100644
--- a/cmd/debug/debug_v23_test.go
+++ b/cmd/debug/debug_v23_test.go
@@ -20,7 +20,7 @@
 //go:generate v23 test generate
 
 func V23TestDebugGlob(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	binary := i.BuildV23Pkg("v.io/x/ref/cmd/debug")
 	inv := binary.Start("glob", "__debug/*")
@@ -35,7 +35,7 @@
 }
 
 func V23TestDebugGlobLogs(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	// Create a temp file before we list the logs.
 	fileName := filepath.Base(i.NewTempFile().Name())
@@ -50,7 +50,7 @@
 }
 
 func V23TestReadHostname(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	path := "__debug/stats/system/hostname"
 	binary := i.BuildV23Pkg("v.io/x/ref/cmd/debug")
@@ -74,7 +74,7 @@
 }
 
 func V23TestLogSize(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	binary := i.BuildV23Pkg("v.io/x/ref/cmd/debug")
 	testLogData := "This is a test log file"
@@ -93,7 +93,7 @@
 }
 
 func V23TestStatsRead(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	binary := i.BuildV23Pkg("v.io/x/ref/cmd/debug")
 	testLogData := "This is a test log file\n"
@@ -113,7 +113,7 @@
 }
 
 func V23TestStatsWatch(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	binary := i.BuildV23Pkg("v.io/x/ref/cmd/debug")
 	testLogData := "This is a test log file\n"
@@ -148,11 +148,11 @@
 }
 
 func performTracedRead(debugBinary *v23tests.Binary, path string) string {
-	return debugBinary.Start("--veyron.vtrace.sample_rate=1", "logs", "read", path).Output()
+	return debugBinary.Start("--v23.vtrace.sample-rate=1", "logs", "read", path).Output()
 }
 
 func V23TestVTrace(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	binary := i.BuildV23Pkg("v.io/x/ref/cmd/debug")
 	logContent := "Hello, world!\n"
@@ -205,7 +205,7 @@
 }
 
 func V23TestPprof(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	binary := i.BuildV23Pkg("v.io/x/ref/cmd/debug")
 	inv := binary.Start("pprof", "run", "__debug/pprof", "heap", "--text")
diff --git a/cmd/debug/doc.go b/cmd/debug/doc.go
index 8c78afd..bdb3a7b 100644
--- a/cmd/debug/doc.go
+++ b/cmd/debug/doc.go
@@ -35,6 +35,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/debug/impl.go b/cmd/debug/impl.go
index 0207ab8..fa4e3a1 100644
--- a/cmd/debug/impl.go
+++ b/cmd/debug/impl.go
@@ -17,10 +17,10 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/logreader"
-	"v.io/v23/services/mgmt/pprof"
-	"v.io/v23/services/mgmt/stats"
-	vtracesvc "v.io/v23/services/mgmt/vtrace"
+	"v.io/v23/services/logreader"
+	"v.io/v23/services/pprof"
+	"v.io/v23/services/stats"
+	s_vtrace "v.io/v23/services/vtrace"
 	"v.io/v23/services/watch"
 	"v.io/v23/uniqueid"
 	"v.io/v23/vdl"
@@ -72,7 +72,7 @@
 `,
 }
 
-func doFetchTrace(ctx *context.T, wg *sync.WaitGroup, client vtracesvc.StoreClientStub,
+func doFetchTrace(ctx *context.T, wg *sync.WaitGroup, client s_vtrace.StoreClientStub,
 	id uniqueid.Id, traces chan *vtrace.TraceRecord, errors chan error) {
 	defer wg.Done()
 
@@ -91,7 +91,7 @@
 	}
 
 	name := args[0]
-	client := vtracesvc.StoreClient(name)
+	client := s_vtrace.StoreClient(name)
 	if arglen == 1 {
 		call, err := client.AllTraces(gctx)
 		if err != nil {
diff --git a/cmd/gclogs/doc.go b/cmd/gclogs/doc.go
index eb15ca1..b46e899 100644
--- a/cmd/gclogs/doc.go
+++ b/cmd/gclogs/doc.go
@@ -47,6 +47,33 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify an acl file as <name>:<aclfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime acl as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.acl.file=map[]
diff --git a/cmd/mgmt/device/acl_impl.go b/cmd/mgmt/device/acl_impl.go
index 65f427a..0b02e14 100644
--- a/cmd/mgmt/device/acl_impl.go
+++ b/cmd/mgmt/device/acl_impl.go
@@ -11,7 +11,7 @@
 
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/v23/verror"
 	"v.io/x/lib/cmdline"
 )
diff --git a/cmd/mgmt/device/associate_impl.go b/cmd/mgmt/device/associate_impl.go
index a387445..45a8a0c 100644
--- a/cmd/mgmt/device/associate_impl.go
+++ b/cmd/mgmt/device/associate_impl.go
@@ -9,7 +9,7 @@
 	"time"
 
 	"v.io/v23/context"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/x/lib/cmdline"
 )
 
diff --git a/cmd/mgmt/device/devicemanager_mock_test.go b/cmd/mgmt/device/devicemanager_mock_test.go
index 41b2190..42d502f 100644
--- a/cmd/mgmt/device/devicemanager_mock_test.go
+++ b/cmd/mgmt/device/devicemanager_mock_test.go
@@ -18,10 +18,10 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/device"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/application"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/device"
+	"v.io/v23/services/repository"
 	"v.io/x/lib/vlog"
 
 	binlib "v.io/x/ref/services/mgmt/lib/binary"
diff --git a/cmd/mgmt/device/devicex b/cmd/mgmt/device/devicex
index e70c0e2..7e53c30 100755
--- a/cmd/mgmt/device/devicex
+++ b/cmd/mgmt/device/devicex
@@ -16,21 +16,21 @@
   echo "usage:"
   echo
   echo "Install device manager:"
-  echo "VANADIUM_DEVICE_DIR=<installation dir> ./devicex install [<binary source>] [ args for installer... ] [ -- args for device manager...]"
+  echo "V23_DEVICE_DIR=<installation dir> ./devicex install [<binary source>] [ args for installer... ] [ -- args for device manager...]"
   echo "  Possible values for <binary source>:"
   echo "     unspecified: get binaries from local repository"
   echo "     /path/to/binaries: get binaries from local filesystem"
   echo "     http://host/path: get binaries from HTTP server"
   echo
   echo "Uninstall device manager:"
-  echo "VANADIUM_DEVICE_DIR=<installation dir> ./devicex uninstall"
+  echo "V23_DEVICE_DIR=<installation dir> ./devicex uninstall"
   echo
   echo "Start device manager:"
-  echo "VANADIUM_DEVICE_DIR=<installation dir> ./devicex start"
+  echo "V23_DEVICE_DIR=<installation dir> ./devicex start"
   echo
   echo "Stop device manager:"
-  echo "VANADIUM_DEVICE_DIR=<installation dir> ./devicex stop"
-  echo "VANADIUM_DEVICE_DIR should be 0711 when running in multi-user"
+  echo "V23_DEVICE_DIR=<installation dir> ./devicex stop"
+  echo "V23_DEVICE_DIR should be 0711 when running in multi-user"
   echo "mode and all of its parents directories need to be at least"
   echo "0511."
 }
@@ -72,10 +72,10 @@
 }
 
 ###############################################################################
-# Runs a command as the device manager user.  Assumes VANADIUM_DEVICE_DIR exists
+# Runs a command as the device manager user.  Assumes V23_DEVICE_DIR exists
 # and gets the device manager user from the owner of that directory.
 # Globals:
-#   VANADIUM_DEVICE_DIR
+#   V23_DEVICE_DIR
 # Arguments:
 #   command to run and its arguments
 # Returns:
@@ -88,7 +88,7 @@
   else
     sudo -u "${devmgr_user}" \
       V23_NAMESPACE="${V23_NAMESPACE}" \
-      VANADIUM_DEVICE_DIR="${VANADIUM_DEVICE_DIR}" \
+      V23_DEVICE_DIR="${V23_DEVICE_DIR}" \
       "$@"
   fi
 }
@@ -183,7 +183,7 @@
 # Installs device manager: fetches binaries, configures suidhelper, calls the
 # install command on deviced.
 # Globals:
-#   VANADIUM_DEVICE_DIR
+#   V23_DEVICE_DIR
 # Arguments:
 #   source of binaries (optional)
 #   args for install command and for device manager (optional)
@@ -191,12 +191,12 @@
 #   None
 ###############################################################################
 install() {
-  if [[ -e "${VANADIUM_DEVICE_DIR}" ]]; then
-    echo "${VANADIUM_DEVICE_DIR} already exists!"
+  if [[ -e "${V23_DEVICE_DIR}" ]]; then
+    echo "${V23_DEVICE_DIR} already exists!"
     exit 1
   fi
-  mkdir -m 711 "${VANADIUM_DEVICE_DIR}"
-  local -r BIN_INSTALL="${VANADIUM_DEVICE_DIR}/bin"
+  mkdir -m 711 "${V23_DEVICE_DIR}"
+  local -r BIN_INSTALL="${V23_DEVICE_DIR}/bin"
   mkdir -m 700 "${BIN_INSTALL}"
 
   # Fetch the binaries.
@@ -249,7 +249,7 @@
   fi
   local -r SETUID_SCRIPT="${BIN_INSTALL}/suidhelper"
   if [[ ${SINGLE_USER} == false ]]; then
-    portable_chown -R "${DEVMGR_USER}:${DEVMGR_USER}" "${VANADIUM_DEVICE_DIR}"
+    portable_chown -R "${DEVMGR_USER}:${DEVMGR_USER}" "${V23_DEVICE_DIR}"
     make_suid "${SETUID_SCRIPT}"
   fi
   local -r INIT_SCRIPT="${BIN_INSTALL}/inithelper"
@@ -259,8 +259,8 @@
   echo "Helpers configured."
 
   # Install the device manager.
-  echo "Installing device manager under ${VANADIUM_DEVICE_DIR} ..."
-  echo "VANADIUM_DEVICE_DIR=${VANADIUM_DEVICE_DIR}"
+  echo "Installing device manager under ${V23_DEVICE_DIR} ..."
+  echo "V23_DEVICE_DIR=${V23_DEVICE_DIR}"
   run "${BIN_INSTALL}/deviced" install \
     --suid_helper="${SETUID_SCRIPT}" \
     --agent="${BIN_INSTALL}/agentd" \
@@ -271,7 +271,7 @@
 ###############################################################################
 # Determines the owner of the device manager
 # Globals:
-#   VANADIUM_DEVICE_DIR
+#   V23_DEVICE_DIR
 # Arguments:
 #   None
 # Returns:
@@ -280,10 +280,10 @@
 getdevowner() {
   case "$(uname)" in
     "Darwin")
-      ls -dl  "${VANADIUM_DEVICE_DIR}" | awk '{print $3}'
+      ls -dl  "${V23_DEVICE_DIR}" | awk '{print $3}'
       ;;
     "Linux")
-      stat -c "%U" "${VANADIUM_DEVICE_DIR}"
+      stat -c "%U" "${V23_DEVICE_DIR}"
       ;;
   esac
 }
@@ -292,78 +292,78 @@
 # Uninstalls device manager: calls the uninstall command of deviced and removes
 # the installation.
 # Globals:
-#   VANADIUM_DEVICE_DIR
+#   V23_DEVICE_DIR
 # Arguments:
 #   None
 # Returns:
 #   None
 ###############################################################################
 uninstall() {
-  if [[ ! -d "${VANADIUM_DEVICE_DIR}" ]]; then
-    echo "${VANADIUM_DEVICE_DIR} does not exist or is not a directory!"
+  if [[ ! -d "${V23_DEVICE_DIR}" ]]; then
+    echo "${V23_DEVICE_DIR} does not exist or is not a directory!"
     exit 1
   fi
-  local -r BIN_INSTALL="${VANADIUM_DEVICE_DIR}/bin"
+  local -r BIN_INSTALL="${V23_DEVICE_DIR}/bin"
   local -r SETUID_SCRIPT="${BIN_INSTALL}/suidhelper"
-  echo "Uninstalling device manager from ${VANADIUM_DEVICE_DIR} ..."
+  echo "Uninstalling device manager from ${V23_DEVICE_DIR} ..."
   run "${BIN_INSTALL}/deviced" uninstall \
     --suid_helper="${SETUID_SCRIPT}"
 
    echo "Device manager uninstalled."
-   # Any data created underneath "${VANADIUM_DEVICE_DIR}" by the "deviced
+   # Any data created underneath "${V23_DEVICE_DIR}" by the "deviced
    # install" command would have been cleaned up already by "deviced uninstall".
-   # However, install() created "${VANADIUM_DEVICE_DIR}", so uninstall() needs
+   # However, install() created "${V23_DEVICE_DIR}", so uninstall() needs
    # to remove it (as well as data created by install(), like bin/*).
 
-   run rm -rf "${VANADIUM_DEVICE_DIR}/bin"
-   rmdir "${VANADIUM_DEVICE_DIR}"
-   echo "Removed ${VANADIUM_DEVICE_DIR}"
+   run rm -rf "${V23_DEVICE_DIR}/bin"
+   rmdir "${V23_DEVICE_DIR}"
+   echo "Removed ${V23_DEVICE_DIR}"
 }
 
 ###############################################################################
 # Starts device manager: calls the start command of deviced.
 # Globals:
-#   VANADIUM_DEVICE_DIR
+#   V23_DEVICE_DIR
 # Arguments:
 #   None
 # Returns:
 #   None
 ###############################################################################
 start() {
-  if [[ ! -d "${VANADIUM_DEVICE_DIR}" ]]; then
-    echo "${VANADIUM_DEVICE_DIR} does not exist or is not a directory!"
+  if [[ ! -d "${V23_DEVICE_DIR}" ]]; then
+    echo "${V23_DEVICE_DIR} does not exist or is not a directory!"
     exit 1
   fi
-  local -r BIN_INSTALL="${VANADIUM_DEVICE_DIR}/bin"
+  local -r BIN_INSTALL="${V23_DEVICE_DIR}/bin"
     run "${BIN_INSTALL}/deviced" start
 }
 
 ###############################################################################
 # Stops device manager: calls the stop command of deviced.
 # Globals:
-#   VANADIUM_DEVICE_DIR
+#   V23_DEVICE_DIR
 # Arguments:
 #   None
 # Returns:
 #   None
 ###############################################################################
 stop() {
-  if [[ ! -d "${VANADIUM_DEVICE_DIR}" ]]; then
-    echo "${VANADIUM_DEVICE_DIR} does not exist or is not a directory!"
+  if [[ ! -d "${V23_DEVICE_DIR}" ]]; then
+    echo "${V23_DEVICE_DIR} does not exist or is not a directory!"
     exit 1
   fi
-  local -r BIN_INSTALL="${VANADIUM_DEVICE_DIR}/bin"
+  local -r BIN_INSTALL="${V23_DEVICE_DIR}/bin"
   run "${BIN_INSTALL}/deviced" stop
 }
 
 main() {
-  if [[ -z "${VANADIUM_DEVICE_DIR}" ]]; then
+  if [[ -z "${V23_DEVICE_DIR}" ]]; then
     echo 'No local device installation dir specified!'
     usage
     exit 1
   fi
-  if [[ -e "${VANADIUM_DEVICE_DIR}" && ! -d "${VANADIUM_DEVICE_DIR}" ]]; then
-    echo "${VANADIUM_DEVICE_DIR} is not a directory!"
+  if [[ -e "${V23_DEVICE_DIR}" && ! -d "${V23_DEVICE_DIR}" ]]; then
+    echo "${V23_DEVICE_DIR} is not a directory!"
     usage
     exit 1
   fi
diff --git a/cmd/mgmt/device/doc.go b/cmd/mgmt/device/doc.go
index 178bfd8..42a8873 100644
--- a/cmd/mgmt/device/doc.go
+++ b/cmd/mgmt/device/doc.go
@@ -48,6 +48,33 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify an acl file as <name>:<aclfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime acl as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.acl.file=map[]
diff --git a/cmd/mgmt/device/impl.go b/cmd/mgmt/device/impl.go
index a27bf6c..bfd28cb 100644
--- a/cmd/mgmt/device/impl.go
+++ b/cmd/mgmt/device/impl.go
@@ -15,8 +15,8 @@
 	"v.io/v23/options"
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/application"
+	"v.io/v23/services/device"
 	"v.io/x/lib/cmdline"
 )
 
diff --git a/cmd/mgmt/device/impl_test.go b/cmd/mgmt/device/impl_test.go
index 313fdeb..bc5ea53 100644
--- a/cmd/mgmt/device/impl_test.go
+++ b/cmd/mgmt/device/impl_test.go
@@ -15,8 +15,8 @@
 
 	"v.io/v23"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/application"
+	"v.io/v23/services/device"
 	"v.io/v23/verror"
 
 	cmd_device "v.io/x/ref/cmd/mgmt/device"
diff --git a/cmd/mgmt/device/instance_impl.go b/cmd/mgmt/device/instance_impl.go
index e927860..e6c3289 100644
--- a/cmd/mgmt/device/instance_impl.go
+++ b/cmd/mgmt/device/instance_impl.go
@@ -9,7 +9,7 @@
 import (
 	"fmt"
 
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/x/lib/cmdline"
 )
 
diff --git a/cmd/mgmt/device/local_install.go b/cmd/mgmt/device/local_install.go
index f722b65..2116d91 100644
--- a/cmd/mgmt/device/local_install.go
+++ b/cmd/mgmt/device/local_install.go
@@ -20,10 +20,10 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/device"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/application"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/device"
+	"v.io/v23/services/repository"
 	"v.io/v23/uniqueid"
 	"v.io/x/lib/vlog"
 
@@ -247,7 +247,7 @@
 //
 // It sets up an app and binary server that only lives for the duration of the
 // command, and listens on the profile's listen spec.  The caller should set the
-// --veyron.proxy if the machine running the command is not accessible from the
+// --v23.proxy if the machine running the command is not accessible from the
 // device manager.
 //
 // TODO(caprita/ashankar): We should use bi-directional streams to get this
diff --git a/cmd/mgmt/device/local_install_test.go b/cmd/mgmt/device/local_install_test.go
index ce6620b..8524813 100644
--- a/cmd/mgmt/device/local_install_test.go
+++ b/cmd/mgmt/device/local_install_test.go
@@ -17,8 +17,8 @@
 
 	"v.io/v23/naming"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/application"
+	"v.io/v23/services/device"
 
 	cmd_device "v.io/x/ref/cmd/mgmt/device"
 )
diff --git a/cmd/mgmt/device/publish.go b/cmd/mgmt/device/publish.go
index b2e2bc8..3743625 100644
--- a/cmd/mgmt/device/publish.go
+++ b/cmd/mgmt/device/publish.go
@@ -16,7 +16,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/v23/services/permissions"
 	"v.io/v23/verror"
 
diff --git a/cmd/mgmt/device/updateall.go b/cmd/mgmt/device/updateall.go
index 1c7ad91..19b1b04 100644
--- a/cmd/mgmt/device/updateall.go
+++ b/cmd/mgmt/device/updateall.go
@@ -11,7 +11,7 @@
 
 	"v.io/v23"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/v23/verror"
 
 	"v.io/x/lib/cmdline"
diff --git a/cmd/mgmt/mgmt_v23_test.go b/cmd/mgmt/mgmt_v23_test.go
index eff4887..860f478 100644
--- a/cmd/mgmt/mgmt_v23_test.go
+++ b/cmd/mgmt/mgmt_v23_test.go
@@ -98,12 +98,12 @@
 		// waiting to be claimed.
 		//
 		// Other binaries, like applicationd and binaryd will be run by alice.
-		deviceScript = i.BinaryFromPath("device/devicex").WithEnv("VANADIUM_DEVICE_DIR=" + dmInstallDir)
+		deviceScript = i.BinaryFromPath("device/devicex").WithEnv("V23_DEVICE_DIR=" + dmInstallDir)
 
 		mtName = "devices/" + hostname // Name under which the device manager will publish itself.
 	)
 
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 	buildAndCopyBinaries(
 		i,
 		binStagingDir,
@@ -121,7 +121,7 @@
 		userFlag,
 		"--origin="+devicedAppName,
 		"--",
-		"--veyron.tcp.address=127.0.0.1:0",
+		"--v23.tcp.address=127.0.0.1:0",
 		"--neighborhood_name="+fmt.Sprintf("%s-%d-%d", hostname, os.Getpid(), rand.Int())).
 		WaitOrDie(os.Stdout, os.Stderr)
 	deviceScript.Start("start").WaitOrDie(os.Stdout, os.Stderr)
@@ -201,7 +201,7 @@
 	binarydBin.Start(
 		"--name="+binarydName,
 		"--root_dir="+filepath.Join(workDir, "binstore"),
-		"--veyron.tcp.address=127.0.0.1:0",
+		"--v23.tcp.address=127.0.0.1:0",
 		"--http=127.0.0.1:0")
 	sampleAppBinName := binarydName + "/testapp"
 	binaryBin.Run("upload", sampleAppBinName, binarydBin.Path())
@@ -214,12 +214,12 @@
 	applicationdBin.Start(
 		"--name="+appDName,
 		"--store="+mkSubdir(i, workDir, "appstore"),
-		"--veyron.tcp.address=127.0.0.1:0",
+		"--v23.tcp.address=127.0.0.1:0",
 	)
 	sampleAppName := appDName + "/testapp/v0"
 	appPubName := "testbinaryd"
 	appEnvelopeFilename := filepath.Join(workDir, "app.envelope")
-	appEnvelope := fmt.Sprintf("{\"Title\":\"BINARYD\", \"Args\":[\"--name=%s\", \"--root_dir=./binstore\", \"--veyron.tcp.address=127.0.0.1:0\", \"--http=127.0.0.1:0\"], \"Binary\":{\"File\":%q}, \"Env\":[]}", appPubName, sampleAppBinName)
+	appEnvelope := fmt.Sprintf("{\"Title\":\"BINARYD\", \"Args\":[\"--name=%s\", \"--root_dir=./binstore\", \"--v23.tcp.address=127.0.0.1:0\", \"--http=127.0.0.1:0\"], \"Binary\":{\"File\":%q}, \"Env\":[]}", appPubName, sampleAppBinName)
 	ioutil.WriteFile(appEnvelopeFilename, []byte(appEnvelope), 0666)
 	defer os.Remove(appEnvelopeFilename)
 
@@ -325,10 +325,6 @@
 	}
 	namespaceRoot, _ := i.GetVar(envvar.NamespacePrefix)
 	n = mtEP + "/global"
-	// TODO(ashankar): The expected blessings of the namespace root should
-	// also be from some VAR or something.  For now, hardcoded, but this
-	// should be fixed along with
-	// https://github.com/veyron/release-issues/issues/98
 	if got, want := namespaceBin.Run("resolve", n), namespaceRoot; got != want {
 		i.Fatalf("got %q, want %q", got, want)
 	}
diff --git a/cmd/mgmt/shell_test.sh b/cmd/mgmt/shell_test.sh
index dcd853a..9a3be6b 100755
--- a/cmd/mgmt/shell_test.sh
+++ b/cmd/mgmt/shell_test.sh
@@ -168,9 +168,9 @@
   # Start the mounttable daemon.
   local -r MT_LOG=$(shell::tmp_file)
   if [[ -n ${shell_test_RUNNING_UNDER_AGENT+1} ]]; then
-    shell::run_server "${shell_test_DEFAULT_SERVER_TIMEOUT}" "${MT_LOG}" "${MT_LOG}" "${VRUN}" "${MOUNTTABLED_BIN}" --veyron.tcp.address="127.0.0.1:0" &> /dev/null || (cat "${MT_LOG}" && shell_test::fail "line ${LINENO}: failed to start mounttabled")
+    shell::run_server "${shell_test_DEFAULT_SERVER_TIMEOUT}" "${MT_LOG}" "${MT_LOG}" "${VRUN}" "${MOUNTTABLED_BIN}" --v23="127.0.0.1:0" &> /dev/null || (cat "${MT_LOG}" && shell_test::fail "line ${LINENO}: failed to start mounttabled")
   else
-    shell::run_server "${shell_test_DEFAULT_SERVER_TIMEOUT}" "${MT_LOG}" "${MT_LOG}" "${MOUNTTABLED_BIN}" --veyron.tcp.address="127.0.0.1:0" &> /dev/null || (cat "${MT_LOG}" && shell_test::fail "line ${LINENO}: failed to start mounttabled")
+    shell::run_server "${shell_test_DEFAULT_SERVER_TIMEOUT}" "${MT_LOG}" "${MT_LOG}" "${MOUNTTABLED_BIN}" --v23.tcp.address="127.0.0.1:0" &> /dev/null || (cat "${MT_LOG}" && shell_test::fail "line ${LINENO}: failed to start mounttabled")
   fi
   shell::timed_wait_for "${shell_test_DEFAULT_MESSAGE_TIMEOUT}" "${MT_LOG}" "Mount table service" || shell_test::fail "line ${LINENO}: failed to find expected output"
 
@@ -243,9 +243,9 @@
   local -r PRINCIPAL_BIN="$(shell_test::build_go_binary 'v.io/x/ref/cmd/principal')"
   local -r FORKCRED=$(shell::tmp_dir)
   "${PRINCIPAL_BIN}" create --overwrite=true "${FORKCRED}" self >/dev/null || shell_test::fail "line ${LINENO}: create failed"
-  "${PRINCIPAL_BIN}" --veyron.credentials="$1" bless --require_caveats=false "${FORKCRED}" "$2" >blessing || shell_test::fail "line ${LINENO}: bless failed"
-  "${PRINCIPAL_BIN}" --veyron.credentials="${FORKCRED}" store setdefault blessing || shell_test::fail "line ${LINENO}: store setdefault failed"
-  "${PRINCIPAL_BIN}" --veyron.credentials="${FORKCRED}" store set blessing ... || shell_test::fail "line ${LINENO}: store set failed"
+  "${PRINCIPAL_BIN}" --v23.credentials="$1" bless --require_caveats=false "${FORKCRED}" "$2" >blessing || shell_test::fail "line ${LINENO}: bless failed"
+  "${PRINCIPAL_BIN}" --v23.credentials="${FORKCRED}" store setdefault blessing || shell_test::fail "line ${LINENO}: store setdefault failed"
+  "${PRINCIPAL_BIN}" --v23.credentials="${FORKCRED}" store set blessing ... || shell_test::fail "line ${LINENO}: store set failed"
   echo "${FORKCRED}"
 }
 
diff --git a/cmd/mgmt/suid_test.sh b/cmd/mgmt/suid_test.sh
index b7111ee..93c27f0 100755
--- a/cmd/mgmt/suid_test.sh
+++ b/cmd/mgmt/suid_test.sh
@@ -143,7 +143,7 @@
   echo ">> Installing and starting the device manager"
   DM_INSTALL_DIR="${WORKDIR}/dm"
 
-  export VANADIUM_DEVICE_DIR="${DM_INSTALL_DIR}"
+  export V23_DEVICE_DIR="${DM_INSTALL_DIR}"
 
   if [[ "${WITH_SUID}" != "--with_suid" ]]; then
     local -r extra_arg="--single_user"
@@ -156,7 +156,7 @@
     ${extra_arg} \
     --origin="${DEVICED_APP_NAME}" \
     -- \
-    --veyron.tcp.address=127.0.0.1:0 \
+    --v23.tcp.address=127.0.0.1:0 \
     --neighborhood_name="${NEIGHBORHOODNAME}"
 
   "${VRUN}" "${DEVICE_SCRIPT}" start
@@ -220,7 +220,7 @@
   # the device ("alice/myworkstation") can talk to it.
   local -r BINARYD_NAME="binaryd"
   shell_test::start_server "${VRUN}" --name=myworkstation/binaryd "${BINARYD_BIN}" --name="${BINARYD_NAME}" \
-    --root_dir="${WORKDIR}/binstore" --veyron.tcp.address=127.0.0.1:0 --http=127.0.0.1:0 \
+    --root_dir="${WORKDIR}/binstore" --v23.tcp.address=127.0.0.1:0 --http=127.0.0.1:0 \
     || shell_test::fail "line ${LINENO} failed to start binaryd"
 
   # Upload a binary to the binary server.  The binary we upload is binaryd
@@ -237,14 +237,14 @@
   # the device ("alice/myworkstation") can talk to it.
   mkdir -p "${WORKDIR}/appstore"
   shell_test::start_server "${VRUN}" --name=myworkstation/applicationd "${APPLICATIOND_BIN}" --name="${APPLICATIOND_NAME}" \
-    --store="${WORKDIR}/appstore" --veyron.tcp.address=127.0.0.1:0 \
+    --store="${WORKDIR}/appstore" --v23.tcp.address=127.0.0.1:0 \
     || shell_test::fail "line ${LINENO} failed to start applicationd"
 
   # Upload an envelope for our test app.
   local -r SAMPLE_APP_NAME="${APPLICATIOND_NAME}/testapp/v0"
   local -r APP_PUBLISH_NAME="testbinaryd"
   echo ">> Uploading ${SAMPLE_APP_NAME}"
-  echo "{\"Title\":\"BINARYD\", \"Args\":[\"--name=${APP_PUBLISH_NAME}\", \"--root_dir=./binstore\", \"--veyron.tcp.address=127.0.0.1:0\"], \"Binary\":{\"File\":\"${SAMPLE_APP_BIN_NAME}\"}, \"Env\":[]}" > ./app.envelope
+  echo "{\"Title\":\"BINARYD\", \"Args\":[\"--name=${APP_PUBLISH_NAME}\", \"--root_dir=./binstore\", \"--v23.tcp.address=127.0.0.1:0\"], \"Binary\":{\"File\":\"${SAMPLE_APP_BIN_NAME}\"}, \"Env\":[]}" > ./app.envelope
   "${APPLICATION_BIN}" put "${SAMPLE_APP_NAME}" "${DEVICE_PROFILE}" ./app.envelope
   rm ./app.envelope
 
@@ -339,8 +339,8 @@
   wait_for_no_mountentry "${NAMESPACE_BIN}" "5" "${MT_NAME}"
 
   "${DEVICE_SCRIPT}" uninstall
-  if [[ -n "$(ls -A "${VANADIUM_DEVICE_DIR}" 2>/dev/null)" ]]; then
-    shell_test::fail "${VANADIUM_DEVICE_DIR} is not empty"
+  if [[ -n "$(ls -A "${V23_DEVICE_DIR}" 2>/dev/null)" ]]; then
+    shell_test::fail "${V23_DEVICE_DIR} is not empty"
   fi
   shell_test::pass
 }
diff --git a/cmd/mgmt/test.sh b/cmd/mgmt/test.sh
index 0feaf2a..5bca914 100755
--- a/cmd/mgmt/test.sh
+++ b/cmd/mgmt/test.sh
@@ -60,7 +60,7 @@
 
   local -r PRINCIPAL_BIN="$(shell_test::build_go_binary 'v.io/x/ref/cmd/principal')"
 
-  "${PRINCIPAL_BIN}" --veyron.credentials="${CRED}" dump >alice.dump ||  shell_test::fail "line ${LINENO}: ${PRINCIPAL_BIN} dump ${CRED} failed"
+  "${PRINCIPAL_BIN}" --v23.credentials="${CRED}" dump >alice.dump ||  shell_test::fail "line ${LINENO}: ${PRINCIPAL_BIN} dump ${CRED} failed"
   cat alice.dump | rmpublickey >got || shell_test::fail "line ${LINENO}: cat alice.dump | rmpublickey failed"
   cat >want <<EOF
 Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
@@ -83,7 +83,7 @@
 
   local -r PRINCIPAL_BIN="$(shell_test::build_go_binary 'v.io/x/ref/cmd/principal')"
 
-  "${PRINCIPAL_BIN}" --veyron.credentials="${FORKCRED}" dump >alice.dump ||  shell_test::fail "line ${LINENO}: ${PRINCIPAL_BIN} dump ${CRED} failed"
+  "${PRINCIPAL_BIN}" --v23.credentials="${FORKCRED}" dump >alice.dump ||  shell_test::fail "line ${LINENO}: ${PRINCIPAL_BIN} dump ${CRED} failed"
   cat alice.dump | rmpublickey >got || shell_test::fail "line ${LINENO}: cat alice.dump | rmpublickey failed"
   cat >want <<EOF
 Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
diff --git a/cmd/mounttable/doc.go b/cmd/mounttable/doc.go
index 550e923..64fc04b 100644
--- a/cmd/mounttable/doc.go
+++ b/cmd/mounttable/doc.go
@@ -34,6 +34,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/namespace/doc.go b/cmd/namespace/doc.go
index 011de6f..c87d044 100644
--- a/cmd/namespace/doc.go
+++ b/cmd/namespace/doc.go
@@ -8,9 +8,9 @@
 /*
 The namespace tool facilitates interaction with the Vanadium namespace.
 
-The namespace roots are set from the command line via veyron.namespace.root
-options or from environment variables that have a name starting with
-V23_NAMESPACE, e.g. V23_NAMESPACE, V23_NAMESPACE_2, V23_NAMESPACE_GOOGLE, etc.
+The namespace roots are set from the command line via --v23.namespace.root
+command line option or from environment variables that have a name starting with
+V23_NAMESPACE, e.g.  V23_NAMESPACE, V23_NAMESPACE_2, V23_NAMESPACE_GOOGLE, etc.
 The command line options override the environment.
 
 Usage:
@@ -40,6 +40,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/namespace/impl.go b/cmd/namespace/impl.go
index 113b909..08483ca 100644
--- a/cmd/namespace/impl.go
+++ b/cmd/namespace/impl.go
@@ -155,7 +155,7 @@
 
 	ns := v23.GetNamespace(ctx)
 
-	var opts []naming.ResolveOpt
+	var opts []naming.NamespaceOpt
 	if flagInsecureResolve {
 		opts = append(opts, options.SkipServerEndpointAuthorization{})
 	}
@@ -189,7 +189,7 @@
 	defer cancel()
 
 	ns := v23.GetNamespace(ctx)
-	var opts []naming.ResolveOpt
+	var opts []naming.NamespaceOpt
 	if flagInsecureResolveToMT {
 		opts = append(opts, options.SkipServerEndpointAuthorization{})
 	}
@@ -213,9 +213,10 @@
 		Long: `
 The namespace tool facilitates interaction with the Vanadium namespace.
 
-The namespace roots are set from the command line via veyron.namespace.root options or from environment variables that have a name
-starting with V23_NAMESPACE, e.g. V23_NAMESPACE, V23_NAMESPACE_2,
-V23_NAMESPACE_GOOGLE, etc. The command line options override the environment.
+The namespace roots are set from the command line via --v23.namespace.root
+command line option or from environment variables that have a name starting
+with V23_NAMESPACE, e.g.  V23_NAMESPACE, V23_NAMESPACE_2, V23_NAMESPACE_GOOGLE,
+etc.  The command line options override the environment.
 `,
 		Children: []*cmdline.Command{cmdGlob, cmdMount, cmdUnmount, cmdResolve, cmdResolveToMT},
 	}
diff --git a/cmd/principal/doc.go b/cmd/principal/doc.go
index a461daf..54099fd 100644
--- a/cmd/principal/doc.go
+++ b/cmd/principal/doc.go
@@ -47,6 +47,33 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify an acl file as <name>:<aclfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime acl as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.acl.file=map[]
@@ -180,11 +207,11 @@
 
 Typically, this command should require no arguments. However, if the sender and
 receiver are on different network domains, it may make sense to use the
---veyron.proxy flag:
-    principal --veyron.proxy=proxy recvblessings
+--v23.proxy flag:
+    principal --v23.proxy=proxy recvblessings
 
 The command to be run at the sender is of the form:
-    principal bless --remote_key=KEY --remote_token=TOKEN ADDRESS
+    principal bless --remote_key=KEY --remote_token=TOKEN ADDRESS EXTENSION
 
 The --remote_key flag is used to by the sender to "authenticate" the receiver,
 ensuring it blesses the intended recipient and not any attacker that may have
@@ -194,6 +221,11 @@
 receiver. This helps ensure that the receiver rejects blessings from senders who
 just happened to guess the network address of the 'recvblessings' invocation.
 
+If the --remote_arg_file flag is provided to recvblessings, the remote key,
+remote token and object address of this principal will be written to the
+specified location. This file can be supplied to bless:
+		principal bless --remote_arg_file FILE EXTENSION
+
 Usage:
    principal recvblessings [flags]
 
@@ -201,6 +233,10 @@
  -for_peer=...
    If non-empty, the blessings received will be marked for peers matching this
    pattern in the store
+ -remote_arg_file=
+   If non-empty, the remote key, remote token, and principal will be written to
+   the specified file in a JSON object. This can be provided to 'principal bless
+   --remote_arg_file FILE EXTENSION'.
  -set_default=true
    If true, the blessings received will be set as the default blessing in the
    store
@@ -263,8 +299,11 @@
 dumped to STDOUT but sent to the remote end. Use 'principal help recvblessings'
 for more details on that.
 
+When --remote_arg_file is specified, only the blessing extension is required, as
+all other arguments will be extracted from the specified file.
+
 Usage:
-   principal bless [flags] <principal to bless> <extension>
+   principal bless [flags] [<principal to bless>] <extension>
 
 <principal to bless> represents the principal to be blessed (i.e., whose public
 key will be provided with a name).  This can be either: (a) The directory
@@ -274,6 +313,9 @@
 OR (c) The object name produced by the 'recvblessings' command of this tool
     running on behalf of another principal (if the --remote_key and
     --remote_token flags are specified).
+OR (d) None (if the --remote_arg_file flag is specified, only <extension> should
+be provided
+    to bless).
 
 <extension> is the string extension that will be applied to create the blessing.
 
@@ -282,6 +324,10 @@
    "package/path".CaveatName:VDLExpressionParam to attach to this blessing
  -for=0
    Duration of blessing validity (zero implies no expiration caveat)
+ -remote_arg_file=
+   File containing bless arguments written by 'principal recvblessings
+   -remote_arg_file FILE EXTENSION' command. This can be provided to bless in
+   place of --remote_key, --remote_token, and <principal>.
  -remote_key=
    Public key of the remote principal to bless (obtained from the
    'recvblessings' command run by the remote principal
@@ -400,13 +446,13 @@
 
 For example, to make the principal in credentials directory A recognize the root
 of the default blessing in credentials directory B:
-  principal -veyron.credentials=B bless A some_extension |
-  principal -veyron.credentials=A addtoroots -
+  principal -v23.credentials=B bless A some_extension |
+  principal -v23.credentials=A addtoroots -
 The extension 'some_extension' has no effect in the command above.
 
 Or to make the principal in credentials director A recognize the base64-encoded
 public key KEY for blessing patterns P:
-  principal -veyron.credentials=A addtoroots KEY P
+  principal -v23.credentials=A addtoroots KEY P
 
 Usage:
    principal addtoroots <key|blessing> [<blessing pattern>]
diff --git a/cmd/principal/main.go b/cmd/principal/main.go
index 8700c37..3e67cb7 100644
--- a/cmd/principal/main.go
+++ b/cmd/principal/main.go
@@ -12,8 +12,10 @@
 	"crypto/rand"
 	"crypto/subtle"
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"os/user"
 	"time"
@@ -57,6 +59,7 @@
 	// Flags common to many commands
 	flagAddToRoots      bool
 	flagCreateOverwrite bool
+	flagRemoteArgFile   string
 
 	// Flags for the "recvblessings" command
 	flagRecvBlessingsSetDefault bool
@@ -193,8 +196,11 @@
 bless a principal on a remote machine as well. In this case, the blessing is
 not dumped to STDOUT but sent to the remote end. Use 'principal help
 recvblessings' for more details on that.
+
+When --remote_arg_file is specified, only the blessing extension is required, as all other
+arguments will be extracted from the specified file.
 `,
-		ArgsName: "<principal to bless> <extension>",
+		ArgsName: "[<principal to bless>] <extension>",
 		ArgsLong: `
 <principal to bless> represents the principal to be blessed (i.e., whose public
 key will be provided with a name).  This can be either:
@@ -206,13 +212,19 @@
 (c) The object name produced by the 'recvblessings' command of this tool
     running on behalf of another principal (if the --remote_key and
     --remote_token flags are specified).
+OR
+(d) None (if the --remote_arg_file flag is specified, only <extension> should be provided
+    to bless).
 
 <extension> is the string extension that will be applied to create the
 blessing.
+
 	`,
 		Run: func(cmd *cmdline.Command, args []string) error {
-			if len(args) != 2 {
-				return fmt.Errorf("require exactly two arguments, provided %d", len(args))
+			if len(flagRemoteArgFile) > 0 && len(args) != 1 {
+				return fmt.Errorf("when --remote_arg_file is provided, only <extension> is expected, provided %d", len(args))
+			} else if len(flagRemoteArgFile) == 0 && len(args) != 2 {
+				return fmt.Errorf("require exactly two arguments when --remote_arg_file is not provided, provided %d", len(args))
 			}
 
 			ctx, shutdown := v23.Init()
@@ -241,33 +253,23 @@
 			if len(caveats) == 0 {
 				return errNoCaveats
 			}
-			tobless, extension := args[0], args[1]
-			if (len(flagBlessRemoteKey) == 0) != (len(flagBlessRemoteToken) == 0) {
-				return fmt.Errorf("either both --remote_key and --remote_token should be set, or neither should")
-			}
-			if len(flagBlessRemoteKey) > 0 {
-				// Send blessings to a "server" started by a "recvblessings" command
-				granter := &granter{p, with, extension, caveats, flagBlessRemoteKey}
-				return sendBlessings(ctx, tobless, granter, flagBlessRemoteToken)
-			}
-			// Blessing a principal whose key is available locally.
-			var key security.PublicKey
-			if finfo, err := os.Stat(tobless); err == nil && finfo.IsDir() {
-				other, err := vsecurity.LoadPersistentPrincipal(tobless, nil)
-				if err != nil {
-					if other, err = vsecurity.CreatePersistentPrincipal(tobless, nil); err != nil {
-						return fmt.Errorf("failed to read principal in directory %q: %v", tobless, err)
-					}
-				}
-				key = other.PublicKey()
-			} else if other, err := decodeBlessings(tobless); err != nil {
-				return fmt.Errorf("failed to decode blessings in %q: %v", tobless, err)
-			} else {
-				key = other.PublicKey()
-			}
-			blessings, err := p.Bless(key, with, extension, caveats[0], caveats[1:]...)
+
+			tobless, extension, remoteKey, remoteToken, err := blessArgs(args)
 			if err != nil {
-				return fmt.Errorf("Bless(%v, %v, %q, ...) failed: %v", key, with, extension, err)
+				return err
+			}
+
+			// Send blessings to a "server" started by a "recvblessings" command, either
+			// with the --remote_arg_file flag, or with --remote_key and --remote_token flags.
+			if len(remoteKey) > 0 {
+				granter := &granter{p, with, extension, caveats, remoteKey}
+				return blessOverNetwork(ctx, tobless, granter, remoteToken)
+			}
+
+			// Blessing a principal whose key is available locally.
+			blessings, err := blessOverFileSystem(p, tobless, with, extension, caveats)
+			if err != nil {
+				return err
 			}
 			return dumpBlessings(blessings)
 		},
@@ -374,13 +376,13 @@
 
 For example, to make the principal in credentials directory A recognize the
 root of the default blessing in credentials directory B:
-  principal -veyron.credentials=B bless A some_extension |
-  principal -veyron.credentials=A addtoroots -
+  principal -v23.credentials=B bless A some_extension |
+  principal -v23.credentials=A addtoroots -
 The extension 'some_extension' has no effect in the command above.
 
 Or to make the principal in credentials director A recognize the base64-encoded
 public key KEY for blessing patterns P:
-  principal -veyron.credentials=A addtoroots KEY P
+  principal -v23.credentials=A addtoroots KEY P
 `,
 		ArgsName: "<key|blessing> [<blessing pattern>]",
 		ArgsLong: `
@@ -653,11 +655,11 @@
 
 Typically, this command should require no arguments.
 However, if the sender and receiver are on different network domains, it may
-make sense to use the --veyron.proxy flag:
-    principal --veyron.proxy=proxy recvblessings
+make sense to use the --v23.proxy flag:
+    principal --v23.proxy=proxy recvblessings
 
 The command to be run at the sender is of the form:
-    principal bless --remote_key=KEY --remote_token=TOKEN ADDRESS
+    principal bless --remote_key=KEY --remote_token=TOKEN ADDRESS EXTENSION
 
 The --remote_key flag is used to by the sender to "authenticate" the receiver,
 ensuring it blesses the intended recipient and not any attacker that may have
@@ -667,6 +669,12 @@
 receiver. This helps ensure that the receiver rejects blessings from senders
 who just happened to guess the network address of the 'recvblessings'
 invocation.
+
+If the --remote_arg_file flag is provided to recvblessings, the remote key, remote token
+and object address of this principal will be written to the specified location.
+This file can be supplied to bless:
+		principal bless --remote_arg_file FILE EXTENSION
+
 `,
 		Run: func(cmd *cmdline.Command, args []string) error {
 			if len(args) != 0 {
@@ -705,7 +713,15 @@
 			fmt.Println("You may want to adjust flags affecting the caveats on this blessing, for example using")
 			fmt.Println("the --for flag, or change the extension to something more meaningful")
 			fmt.Println()
-			fmt.Printf("principal bless --remote_key=%v --remote_token=%v %v %v\n", p.PublicKey(), service.token, eps[0].Name(), extension)
+			if len(flagRemoteArgFile) > 0 {
+				if err := writeRecvBlessingsInfo(flagRemoteArgFile, p.PublicKey().String(), service.token, eps[0].Name()); err != nil {
+					return fmt.Errorf("failed to write recvblessings info to %v: %v", flagRemoteArgFile, err)
+				}
+				fmt.Printf("make %q accessible to the blesser, possibly by copying the file over and then run:\n", flagRemoteArgFile)
+				fmt.Printf("principal bless --remote_arg_file=%v %v", flagRemoteArgFile, extension)
+			} else {
+				fmt.Printf("principal bless --remote_key=%v --remote_token=%v %v %v\n", p.PublicKey(), service.token, eps[0].Name(), extension)
+			}
 			fmt.Println()
 			fmt.Println("...waiting for sender..")
 			return <-service.notify
@@ -713,6 +729,76 @@
 	}
 )
 
+func blessArgs(args []string) (tobless, extension, remoteKey, remoteToken string, err error) {
+	if len(flagRemoteArgFile) > 0 && (len(flagBlessRemoteKey)+len(flagBlessRemoteToken) > 0) {
+		return "", "", "", "", fmt.Errorf("--remote_key and --remote_token cannot be provided with --remote_arg_file")
+	}
+	if (len(flagBlessRemoteKey) == 0) != (len(flagBlessRemoteToken) == 0) {
+		return "", "", "", "", fmt.Errorf("either both --remote_key and --remote_token should be set, or neither should")
+	}
+
+	if len(flagRemoteArgFile) == 0 {
+		tobless, extension = args[0], args[1]
+		remoteKey = flagBlessRemoteKey
+		remoteToken = flagBlessRemoteToken
+	} else if len(flagRemoteArgFile) > 0 {
+		extension = args[0]
+		remoteKey, remoteToken, tobless, err = blessArgsFromFile(flagRemoteArgFile)
+	}
+	return
+}
+
+func blessOverFileSystem(p security.Principal, tobless string, with security.Blessings, extension string, caveats []security.Caveat) (security.Blessings, error) {
+	var key security.PublicKey
+	if finfo, err := os.Stat(tobless); err == nil && finfo.IsDir() {
+		other, err := vsecurity.LoadPersistentPrincipal(tobless, nil)
+		if err != nil {
+			if other, err = vsecurity.CreatePersistentPrincipal(tobless, nil); err != nil {
+				return security.Blessings{}, fmt.Errorf("failed to read principal in directory %q: %v", tobless, err)
+			}
+		}
+		key = other.PublicKey()
+	} else if other, err := decodeBlessings(tobless); err != nil {
+		return security.Blessings{}, fmt.Errorf("failed to decode blessings in %q: %v", tobless, err)
+	} else {
+		key = other.PublicKey()
+	}
+	return p.Bless(key, with, extension, caveats[0], caveats[1:]...)
+}
+
+type recvBlessingsInfo struct {
+	RemoteKey   string `json:remote_key`
+	RemoteToken string `json:remote_token`
+	Name        string `json:name`
+}
+
+func writeRecvBlessingsInfo(fname string, remoteKey, remoteToken, name string) error {
+	f, err := os.OpenFile(fname, os.O_WRONLY|os.O_CREATE, 0666)
+	if err != nil {
+		return err
+	}
+	b, err := json.Marshal(recvBlessingsInfo{remoteKey, remoteToken, name})
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(b); err != nil {
+		return err
+	}
+	return nil
+}
+
+func blessArgsFromFile(fname string) (remoteKey, remoteToken, tobless string, err error) {
+	blessJSON, err := ioutil.ReadFile(fname)
+	if err != nil {
+		return "", "", "", err
+	}
+	var binfo recvBlessingsInfo
+	if err := json.Unmarshal(blessJSON, &binfo); err != nil {
+		return "", "", "", err
+	}
+	return binfo.RemoteKey, binfo.RemoteToken, binfo.Name, err
+}
+
 func main() {
 	cmdBlessSelf.Flags.Var(&flagBlessSelfCaveats, "caveat", flagBlessSelfCaveats.usage())
 	cmdBlessSelf.Flags.DurationVar(&flagBlessSelfFor, "for", 0, "Duration of blessing validity (zero implies no expiration)")
@@ -729,6 +815,7 @@
 	cmdBless.Flags.StringVar(&flagBlessWith, "with", "", "Path to file containing blessing to extend")
 	cmdBless.Flags.StringVar(&flagBlessRemoteKey, "remote_key", "", "Public key of the remote principal to bless (obtained from the 'recvblessings' command run by the remote principal")
 	cmdBless.Flags.StringVar(&flagBlessRemoteToken, "remote_token", "", "Token provided by principal running the 'recvblessings' command")
+	cmdBless.Flags.StringVar(&flagRemoteArgFile, "remote_arg_file", "", "File containing bless arguments written by 'principal recvblessings -remote_arg_file FILE EXTENSION' command. This can be provided to bless in place of --remote_key, --remote_token, and <principal>.")
 
 	cmdSeekBlessings.Flags.StringVar(&flagSeekBlessingsFrom, "from", "https://dev.v.io/auth/google", "URL to use to begin the seek blessings process")
 	cmdSeekBlessings.Flags.BoolVar(&flagSeekBlessingsSetDefault, "set_default", true, "If true, the blessings obtained will be set as the default blessing in the store")
@@ -744,6 +831,7 @@
 
 	cmdRecvBlessings.Flags.BoolVar(&flagRecvBlessingsSetDefault, "set_default", true, "If true, the blessings received will be set as the default blessing in the store")
 	cmdRecvBlessings.Flags.StringVar(&flagRecvBlessingsForPeer, "for_peer", string(security.AllPrincipals), "If non-empty, the blessings received will be marked for peers matching this pattern in the store")
+	cmdRecvBlessings.Flags.StringVar(&flagRemoteArgFile, "remote_arg_file", "", "If non-empty, the remote key, remote token, and principal will be written to the specified file in a JSON object. This can be provided to 'principal bless --remote_arg_file FILE EXTENSION'.")
 
 	cmdSet := &cmdline.Command{
 		Name:  "set",
@@ -948,7 +1036,7 @@
 }
 func (*granter) RPCCallOpt() {}
 
-func sendBlessings(ctx *context.T, object string, granter *granter, remoteToken string) error {
+func blessOverNetwork(ctx *context.T, object string, granter *granter, remoteToken string) error {
 	client := v23.GetClient(ctx)
 	// The receiver is being authorized based on the hash of its public key
 	// (see Grant), so it should be fine to ignore the blessing names in the endpoint
diff --git a/cmd/principal/principal_v23_test.go b/cmd/principal/principal_v23_test.go
index 174e224..c5381b8 100644
--- a/cmd/principal/principal_v23_test.go
+++ b/cmd/principal/principal_v23_test.go
@@ -12,7 +12,6 @@
 	"path/filepath"
 	"regexp"
 	"strings"
-	"syscall"
 
 	"v.io/x/ref/envvar"
 	"v.io/x/ref/test/v23tests"
@@ -85,8 +84,8 @@
 	redirect(t, bin.WithEnv(blessEnv).Start("bless", "--for=1m", bobDir, "friend"), aliceFriend)
 
 	// Run store forpeer on bob.
-	bin.Start("--veyron.credentials="+bobDir, "set", "forpeer", aliceFriend, "alice").WaitOrDie(os.Stdout, os.Stderr)
-	redirect(t, bin.WithEnv(blessEnv).Start("--veyron.credentials="+bobDir, "get", "forpeer", "alice/server"), bobForPeer)
+	bin.Start("--v23.credentials="+bobDir, "set", "forpeer", aliceFriend, "alice").WaitOrDie(os.Stdout, os.Stderr)
+	redirect(t, bin.WithEnv(blessEnv).Start("--v23.credentials="+bobDir, "get", "forpeer", "alice/server"), bobForPeer)
 
 	got := removeCaveats(removePublicKeys(bin.Start("dumpblessings", bobForPeer).Output()))
 	want := `Blessings          : bob#alice/friend
@@ -148,42 +147,50 @@
 
 func V23TestRecvBlessings(t *v23tests.T) {
 	var (
-		outputDir = t.NewTempDir()
-		bin       = t.BuildGoPkg("v.io/x/ref/cmd/principal")
-		aliceDir  = filepath.Join(outputDir, "alice")
-		carolDir  = filepath.Join(outputDir, "carol")
+		outputDir    = t.NewTempDir()
+		bin          = t.BuildGoPkg("v.io/x/ref/cmd/principal")
+		aliceDir     = filepath.Join(outputDir, "alice")
+		bobDir       = filepath.Join(outputDir, "bob")
+		carolDir     = filepath.Join(outputDir, "carol")
+		bobBlessFile = filepath.Join(outputDir, "bobBlessInfo")
 	)
 
 	// Generate principals for alice and carol.
 	bin.Start("create", aliceDir, "alice").WaitOrDie(os.Stdout, os.Stderr)
+	bin.Start("create", bobDir, "bob").WaitOrDie(os.Stdout, os.Stderr)
 	bin.Start("create", carolDir, "carol").WaitOrDie(os.Stdout, os.Stderr)
 
 	// Run recvblessings on carol, and have alice send blessings over
 	// (blessings received must be set as default and shareable with all peers).
 	var args []string
 	{
-		inv := bin.Start("--veyron.credentials="+carolDir, "--veyron.tcp.address=127.0.0.1:0", "recvblessings")
-		defer inv.Kill(syscall.SIGTERM)
+		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings")
 		args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(inv)...)
 		// Replace the random extension suggested by recvblessings with "friend/carol"
 		args[len(args)-1] = "friend/carol"
 	}
-
 	bin.WithEnv(credEnv(aliceDir)).Start(args...).WaitOrDie(os.Stdout, os.Stderr)
 
 	// Run recvblessings on carol, and have alice send blessings over
 	// (blessings received must be set as shareable with peers matching 'alice/...'.)
 	{
-		inv := bin.Start("--veyron.credentials="+carolDir, "--veyron.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=alice", "--set_default=false")
-		defer inv.Kill(syscall.SIGTERM)
+		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=alice", "--set_default=false")
 		// recvblessings suggests a random extension, find the extension and replace it with friend/carol/foralice.
 		args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(inv)...)
 		args[len(args)-1] = "friend/carol/foralice"
 	}
 	bin.WithEnv(credEnv(aliceDir)).Start(args...).WaitOrDie(os.Stdout, os.Stderr)
 
-	listenerInv := bin.Start("--veyron.credentials="+carolDir, "--veyron.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=alice/...", "--set_default=false", "--vmodule=*=2", "--logtostderr")
-	defer listenerInv.Kill(syscall.SIGTERM)
+	// Run recvblessings on carol with the --remote_arg_file flag, and have bob send blessings over with the --remote_arg_file flag.
+	{
+		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=bob", "--set_default=false", "--remote_arg_file="+bobBlessFile)
+		// recvblessings suggests a random extension, use friend/carol/forbob instead.
+		args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(inv)...)
+		args[len(args)-1] = "friend/carol/forbob"
+	}
+	bin.WithEnv(credEnv(bobDir)).Start(args...).WaitOrDie(os.Stdout, os.Stderr)
+
+	listenerInv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=alice/...", "--set_default=false", "--vmodule=*=2", "--logtostderr")
 
 	args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(listenerInv)...)
 
@@ -215,16 +222,18 @@
 
 	// Dump carol out, the only blessing that survives should be from the
 	// first "bless" command. (alice/friend/carol).
-	got := removePublicKeys(bin.Start("--veyron.credentials="+carolDir, "dump").Output())
+	got := removePublicKeys(bin.Start("--v23.credentials="+carolDir, "dump").Output())
 	want := `Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
 ---------------- BlessingStore ----------------
 Default blessings: alice/friend/carol
 Peer pattern                   : Blessings
 ...                            : alice/friend/carol
 alice                          : alice/friend/carol/foralice
+bob                            : bob/friend/carol/forbob
 ---------------- BlessingRoots ----------------
 Public key                                      : Pattern
 XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [alice]
+XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [bob]
 XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX : [carol]
 `
 	if want != got {
@@ -247,11 +256,11 @@
 
 	// Run fork to setup up credentials for alice/phone that are
 	// blessed by alice under the extension "phone".
-	bin.Start("--veyron.credentials="+aliceDir, "fork", "--for", "1h", alicePhoneDir, "phone").WaitOrDie(os.Stdout, os.Stderr)
+	bin.Start("--v23.credentials="+aliceDir, "fork", "--for", "1h", alicePhoneDir, "phone").WaitOrDie(os.Stdout, os.Stderr)
 
 	// Dump alice-phone out, the only blessings it has must be from alice (alice/phone).
 	{
-		got := removePublicKeys(bin.Start("--veyron.credentials="+alicePhoneDir, "dump").Output())
+		got := removePublicKeys(bin.Start("--v23.credentials="+alicePhoneDir, "dump").Output())
 		want := `Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
 ---------------- BlessingStore ----------------
 Default blessings: alice/phone
@@ -267,7 +276,7 @@
 	}
 	// And it should have an expiry caveat
 	{
-		redirect(t, bin.Start("--veyron.credentials", alicePhoneDir, "get", "default"), tmpfile)
+		redirect(t, bin.Start("--v23.credentials", alicePhoneDir, "get", "default"), tmpfile)
 		got := removeCaveats(removePublicKeys(bin.Start("dumpblessings", tmpfile).Output()))
 		want := `Blessings          : alice/phone
 PublicKey          : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
@@ -284,9 +293,9 @@
 
 	// Run fork to setup up credentials for alice/phone/calendar that are
 	// blessed by alice/phone under the extension "calendar".
-	bin.Start("--veyron.credentials="+alicePhoneDir, "fork", "--for", "1h", alicePhoneCalendarDir, "calendar").WaitOrDie(os.Stdout, os.Stderr)
+	bin.Start("--v23.credentials="+alicePhoneDir, "fork", "--for", "1h", alicePhoneCalendarDir, "calendar").WaitOrDie(os.Stdout, os.Stderr)
 	{
-		got := removePublicKeys(bin.Start("--veyron.credentials="+alicePhoneCalendarDir, "dump").Output())
+		got := removePublicKeys(bin.Start("--v23.credentials="+alicePhoneCalendarDir, "dump").Output())
 		want := `Public key : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
 ---------------- BlessingStore ----------------
 Default blessings: alice/phone/calendar
@@ -301,7 +310,7 @@
 		}
 	}
 	{
-		redirect(t, bin.Start("--veyron.credentials", alicePhoneCalendarDir, "get", "default"), tmpfile)
+		redirect(t, bin.Start("--v23.credentials", alicePhoneCalendarDir, "get", "default"), tmpfile)
 		got := removeCaveats(removePublicKeys(bin.Start("dumpblessings", tmpfile).Output()))
 		want := `Blessings          : alice/phone/calendar
 PublicKey          : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
@@ -378,7 +387,7 @@
 	if err := bin.Start("create", parent, "parent").Wait(os.Stdout, os.Stderr); err != nil {
 		t.Fatalf("create %q failed: %v", parent, err)
 	}
-	if err := bin.Start("--veyron.credentials="+parent, "fork", "--for=1s", t.NewTempDir(), "child").Wait(os.Stdout, os.Stderr); err != nil {
+	if err := bin.Start("--v23.credentials="+parent, "fork", "--for=1s", t.NewTempDir(), "child").Wait(os.Stdout, os.Stderr); err != nil {
 		t.Errorf("fork failed: %v", err)
 	}
 }
@@ -393,17 +402,17 @@
 	if err := bin.Start("create", parent, "parent").Wait(os.Stdout, os.Stderr); err != nil {
 		t.Fatalf("create %q failed: %v", parent, err)
 	}
-	if err := bin.Start("--veyron.credentials", parent, "fork", child, "child").Wait(os.Stdout, &buf); err == nil {
+	if err := bin.Start("--v23.credentials", parent, "fork", child, "child").Wait(os.Stdout, &buf); err == nil {
 		t.Errorf("fork should have failed without any caveats, but did not")
 	} else if got, want := buf.String(), "ERROR: no caveats provided"; !strings.Contains(got, want) {
 		t.Errorf("fork returned error: %q, expected error to contain %q", got, want)
 	}
-	if err := bin.Start("--veyron.credentials", parent, "fork", "--for=0", child, "child").Wait(os.Stdout, &buf); err == nil {
+	if err := bin.Start("--v23.credentials", parent, "fork", "--for=0", child, "child").Wait(os.Stdout, &buf); err == nil {
 		t.Errorf("fork should have failed without any caveats, but did not")
 	} else if got, want := buf.String(), "ERROR: no caveats provided"; !strings.Contains(got, want) {
 		t.Errorf("fork returned error: %q, expected error to contain %q", got, want)
 	}
-	if err := bin.Start("--veyron.credentials", parent, "fork", "--require_caveats=false", child, "child").Wait(os.Stdout, os.Stderr); err != nil {
+	if err := bin.Start("--v23.credentials", parent, "fork", "--require_caveats=false", child, "child").Wait(os.Stdout, os.Stderr); err != nil {
 		t.Errorf("fork --require_caveats=false failed with: %v", err)
 	}
 }
@@ -486,7 +495,7 @@
 		// "principal dump", which is formatted as:
 		// Public key : <the public key>
 		publicKey = func(dir string) string {
-			output := bin.Start("--veyron.credentials="+dir, "dump").Output()
+			output := bin.Start("--v23.credentials="+dir, "dump").Output()
 			line := strings.SplitN(output, "\n", 2)[0]
 			fields := strings.Split(line, " ")
 			return fields[len(fields)-1]
@@ -496,8 +505,8 @@
 	bin.Start("create", aliceDir, "alice").WaitOrDie(os.Stdout, os.Stderr)
 	bin.Start("create", bobDir, "bob").WaitOrDie(os.Stdout, os.Stderr)
 	// Have bob create a "bob/friend" blessing and have alice recognize that.
-	redirect(t, bin.Start("--veyron.credentials="+bobDir, "bless", "--require_caveats=false", aliceDir, "friend"), blessingFile)
-	bin.Start("--veyron.credentials="+aliceDir, "addtoroots", blessingFile).WaitOrDie(os.Stdout, os.Stderr)
+	redirect(t, bin.Start("--v23.credentials="+bobDir, "bless", "--require_caveats=false", aliceDir, "friend"), blessingFile)
+	bin.Start("--v23.credentials="+aliceDir, "addtoroots", blessingFile).WaitOrDie(os.Stdout, os.Stderr)
 	var (
 		// blessing roots lines that should match the keys
 		aliceLine = fmt.Sprintf("%v : [alice]", publicKey(aliceDir))
@@ -506,7 +515,7 @@
 		foundAlice, foundBob bool
 	)
 	// Finally dump alice's principal, it should have lines corresponding to aliceLine and bobLine.
-	output := bin.Start("--veyron.credentials="+aliceDir, "dump").Output()
+	output := bin.Start("--v23.credentials="+aliceDir, "dump").Output()
 	for _, line := range strings.Split(output, "\n") {
 		if line == aliceLine {
 			foundAlice = true
@@ -533,9 +542,9 @@
 	//    der, _ := key.MarshalBinary()
 	//    b64 := base64.URLEncoding.EncodeToString(der)  // argument to addtoroots
 	//    str := fmt.Sprintf("%v", key)                  // for the "want" line
-	bin.Start("--veyron.credentials="+aliceDir, "addtoroots", "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9iRjaFDoGJI9tarUwWqIW31ti72krThkYByn1v9Lf89D9VA0Mg2oUL7FDDM7qxjZcVM1ktM_W4tBfMVuRZmVCA==", "some_other_provider").WaitOrDie(os.Stdout, os.Stderr)
+	bin.Start("--v23.credentials="+aliceDir, "addtoroots", "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9iRjaFDoGJI9tarUwWqIW31ti72krThkYByn1v9Lf89D9VA0Mg2oUL7FDDM7qxjZcVM1ktM_W4tBfMVuRZmVCA==", "some_other_provider").WaitOrDie(os.Stdout, os.Stderr)
 	// "foo" should appear in the set of BlessingRoots
-	output := bin.Start("--veyron.credentials="+aliceDir, "dump").Output()
+	output := bin.Start("--v23.credentials="+aliceDir, "dump").Output()
 	want := fmt.Sprintf("41:26:f6:aa:54:f9:31:d4:9d:1f:d2:69:c6:c5:50:70 : [some_other_provider]")
 	for _, line := range strings.Split(output, "\n") {
 		if line == want {
diff --git a/cmd/profile/doc.go b/cmd/profile/doc.go
index e854d2b..85d1ed1 100644
--- a/cmd/profile/doc.go
+++ b/cmd/profile/doc.go
@@ -35,6 +35,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/profile/impl.go b/cmd/profile/impl.go
index 8d438cc..cda78b9 100644
--- a/cmd/profile/impl.go
+++ b/cmd/profile/impl.go
@@ -9,7 +9,7 @@
 	"time"
 
 	"v.io/v23/context"
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/build"
 	"v.io/x/lib/cmdline"
 	"v.io/x/ref/services/mgmt/profile"
 	"v.io/x/ref/services/mgmt/repository"
diff --git a/cmd/profile/impl_test.go b/cmd/profile/impl_test.go
index e89b79c..9f4ace8 100644
--- a/cmd/profile/impl_test.go
+++ b/cmd/profile/impl_test.go
@@ -15,7 +15,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/build"
 	"v.io/x/lib/vlog"
 
 	_ "v.io/x/ref/profiles"
diff --git a/cmd/servicerunner/main.go b/cmd/servicerunner/main.go
index 1f186d4..a04cc1c 100644
--- a/cmd/servicerunner/main.go
+++ b/cmd/servicerunner/main.go
@@ -111,7 +111,7 @@
 	}
 	defer sh.Cleanup(os.Stderr, os.Stderr)
 
-	h, err := sh.Start("rootMT", nil, "--veyron.tcp.protocol=ws", "--veyron.tcp.address=127.0.0.1:0")
+	h, err := sh.Start("rootMT", nil, "--v23.tcp.protocol=ws", "--v23.tcp.address=127.0.0.1:0")
 	panicOnError(err)
 	panicOnError(updateVars(h, vars, "MT_NAME"))
 
@@ -123,11 +123,11 @@
 	defer proxyShutdown()
 	vars["PROXY_NAME"] = proxyEndpoint.Name()
 
-	h, err = sh.Start(WSPRCommand, nil, "--veyron.tcp.protocol=ws", "--veyron.tcp.address=127.0.0.1:0", "--veyron.proxy=test/proxy", "--identd=test/identd")
+	h, err = sh.Start(WSPRCommand, nil, "--v23.tcp.protocol=ws", "--v23.tcp.address=127.0.0.1:0", "--v23.proxy=test/proxy", "--identd=test/identd")
 	panicOnError(err)
 	panicOnError(updateVars(h, vars, "WSPR_ADDR"))
 
-	h, err = sh.Start(identityd.TestIdentitydCommand, nil, "--veyron.tcp.protocol=ws", "--veyron.tcp.address=127.0.0.1:0", "--veyron.proxy=test/proxy", "--httpaddr=localhost:0")
+	h, err = sh.Start(identityd.TestIdentitydCommand, nil, "--v23.tcp.protocol=ws", "--v23.tcp.address=127.0.0.1:0", "--v23.proxy=test/proxy", "--httpaddr=localhost:0")
 	panicOnError(err)
 	panicOnError(updateVars(h, vars, "TEST_IDENTITYD_NAME", "TEST_IDENTITYD_HTTP_ADDR"))
 
diff --git a/cmd/uniqueid/doc.go b/cmd/uniqueid/doc.go
index 67b7de5..6c4c7a5 100644
--- a/cmd/uniqueid/doc.go
+++ b/cmd/uniqueid/doc.go
@@ -33,6 +33,33 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify an acl file as <name>:<aclfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime acl as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.acl.file=map[]
diff --git a/cmd/vdl/doc.go b/cmd/vdl/doc.go
index 0e06c1f..a22d79b 100644
--- a/cmd/vdl/doc.go
+++ b/cmd/vdl/doc.go
@@ -54,6 +54,33 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify an acl file as <name>:<aclfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime acl as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.acl.file=map[]
diff --git a/cmd/vom/doc.go b/cmd/vom/doc.go
index 4fc7d25..bcc38a3 100644
--- a/cmd/vom/doc.go
+++ b/cmd/vom/doc.go
@@ -32,6 +32,33 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify an acl file as <name>:<aclfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime acl as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.acl.file=map[]
diff --git a/cmd/vomtestgen/doc.go b/cmd/vomtestgen/doc.go
index e21085b..f8514f4 100644
--- a/cmd/vomtestgen/doc.go
+++ b/cmd/vomtestgen/doc.go
@@ -46,6 +46,33 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify an acl file as <name>:<aclfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime acl as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.acl.file=map[]
diff --git a/cmd/vrpc/doc.go b/cmd/vrpc/doc.go
index a6ae4eb..e1fa33e 100644
--- a/cmd/vrpc/doc.go
+++ b/cmd/vrpc/doc.go
@@ -34,6 +34,28 @@
    logs at or above this threshold go to stderr
  -v=0
    log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
  -vanadium.i18n_catalogue=
    18n catalogue files to load, comma separated
  -veyron.credentials=
diff --git a/cmd/vrpc/internal/test_base.vdl.go b/cmd/vrpc/internal/test_base.vdl.go
index 742408e..e64d21b 100644
--- a/cmd/vrpc/internal/test_base.vdl.go
+++ b/cmd/vrpc/internal/test_base.vdl.go
@@ -74,31 +74,17 @@
 }
 
 // TypeTesterClient returns a client stub for TypeTester.
-func TypeTesterClient(name string, opts ...rpc.BindOpt) TypeTesterClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implTypeTesterClientStub{name, client}
+func TypeTesterClient(name string) TypeTesterClientStub {
+	return implTypeTesterClientStub{name}
 }
 
 type implTypeTesterClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implTypeTesterClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implTypeTesterClientStub) EchoBool(ctx *context.T, i0 bool, opts ...rpc.CallOpt) (o0 bool, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoBool", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoBool", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -107,7 +93,7 @@
 
 func (c implTypeTesterClientStub) EchoFloat32(ctx *context.T, i0 float32, opts ...rpc.CallOpt) (o0 float32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoFloat32", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoFloat32", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -116,7 +102,7 @@
 
 func (c implTypeTesterClientStub) EchoFloat64(ctx *context.T, i0 float64, opts ...rpc.CallOpt) (o0 float64, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoFloat64", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoFloat64", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -125,7 +111,7 @@
 
 func (c implTypeTesterClientStub) EchoInt32(ctx *context.T, i0 int32, opts ...rpc.CallOpt) (o0 int32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoInt32", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoInt32", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -134,7 +120,7 @@
 
 func (c implTypeTesterClientStub) EchoInt64(ctx *context.T, i0 int64, opts ...rpc.CallOpt) (o0 int64, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoInt64", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoInt64", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -143,7 +129,7 @@
 
 func (c implTypeTesterClientStub) EchoString(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoString", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoString", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -152,7 +138,7 @@
 
 func (c implTypeTesterClientStub) EchoByte(ctx *context.T, i0 byte, opts ...rpc.CallOpt) (o0 byte, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoByte", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoByte", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -161,7 +147,7 @@
 
 func (c implTypeTesterClientStub) EchoUint32(ctx *context.T, i0 uint32, opts ...rpc.CallOpt) (o0 uint32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoUint32", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoUint32", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -170,7 +156,7 @@
 
 func (c implTypeTesterClientStub) EchoUint64(ctx *context.T, i0 uint64, opts ...rpc.CallOpt) (o0 uint64, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoUint64", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoUint64", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -179,7 +165,7 @@
 
 func (c implTypeTesterClientStub) XEchoArray(ctx *context.T, i0 Array2Int, opts ...rpc.CallOpt) (o0 Array2Int, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "XEchoArray", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "XEchoArray", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -188,7 +174,7 @@
 
 func (c implTypeTesterClientStub) XEchoMap(ctx *context.T, i0 map[int32]string, opts ...rpc.CallOpt) (o0 map[int32]string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "XEchoMap", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "XEchoMap", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -197,7 +183,7 @@
 
 func (c implTypeTesterClientStub) XEchoSet(ctx *context.T, i0 map[int32]struct{}, opts ...rpc.CallOpt) (o0 map[int32]struct{}, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "XEchoSet", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "XEchoSet", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -206,7 +192,7 @@
 
 func (c implTypeTesterClientStub) XEchoSlice(ctx *context.T, i0 []int32, opts ...rpc.CallOpt) (o0 []int32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "XEchoSlice", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "XEchoSlice", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -215,7 +201,7 @@
 
 func (c implTypeTesterClientStub) XEchoStruct(ctx *context.T, i0 Struct, opts ...rpc.CallOpt) (o0 Struct, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "XEchoStruct", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "XEchoStruct", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -224,7 +210,7 @@
 
 func (c implTypeTesterClientStub) YMultiArg(ctx *context.T, i0 int32, i1 int32, opts ...rpc.CallOpt) (o0 int32, o1 int32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "YMultiArg", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "YMultiArg", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0, &o1)
@@ -233,7 +219,7 @@
 
 func (c implTypeTesterClientStub) YNoArgs(ctx *context.T, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "YNoArgs", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "YNoArgs", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -242,7 +228,7 @@
 
 func (c implTypeTesterClientStub) ZStream(ctx *context.T, i0 int32, i1 bool, opts ...rpc.CallOpt) (ocall TypeTesterZStreamClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "ZStream", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "ZStream", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	ocall = &implTypeTesterZStreamClientCall{ClientCall: call}
diff --git a/cmd/vrun/vrun.go b/cmd/vrun/vrun.go
index e604d9f..4bdafd1 100644
--- a/cmd/vrun/vrun.go
+++ b/cmd/vrun/vrun.go
@@ -6,6 +6,7 @@
 
 import (
 	"os"
+	"os/exec"
 	"path/filepath"
 	"syscall"
 	"time"
@@ -126,7 +127,12 @@
 		}
 		conn.Close()
 	}
-	err := syscall.Exec(cmd[0], cmd, os.Environ())
+	p, err := exec.LookPath(cmd[0])
+	if err != nil {
+		vlog.Errorf("Couldn't find %q", cmd[0])
+		return err
+	}
+	err = syscall.Exec(p, cmd, os.Environ())
 	vlog.Errorf("Couldn't exec %s.", cmd[0])
 	return err
 }
diff --git a/examples/rps/rpsbot/impl_test.go b/examples/rps/rpsbot/impl_test.go
index e84d749..420e0f2 100644
--- a/examples/rps/rpsbot/impl_test.go
+++ b/examples/rps/rpsbot/impl_test.go
@@ -96,7 +96,7 @@
 		t.Fatalf("Could not create shell: %v", err)
 	}
 	defer sh.Cleanup(os.Stdout, os.Stderr)
-	h, err := sh.Start("rootMT", nil, "--veyron.tcp.address=127.0.0.1:0")
+	h, err := sh.Start("rootMT", nil, "--v23.tcp.address=127.0.0.1:0")
 	if err != nil {
 		if h != nil {
 			h.Shutdown(nil, os.Stderr)
diff --git a/examples/rps/service.vdl.go b/examples/rps/service.vdl.go
index 8cd98c2..efa4a4d 100644
--- a/examples/rps/service.vdl.go
+++ b/examples/rps/service.vdl.go
@@ -265,31 +265,17 @@
 }
 
 // JudgeClient returns a client stub for Judge.
-func JudgeClient(name string, opts ...rpc.BindOpt) JudgeClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implJudgeClientStub{name, client}
+func JudgeClient(name string) JudgeClientStub {
+	return implJudgeClientStub{name}
 }
 
 type implJudgeClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implJudgeClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implJudgeClientStub) CreateGame(ctx *context.T, i0 GameOptions, opts ...rpc.CallOpt) (o0 GameId, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "CreateGame", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "CreateGame", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -298,7 +284,7 @@
 
 func (c implJudgeClientStub) Play(ctx *context.T, i0 GameId, opts ...rpc.CallOpt) (ocall JudgePlayClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Play", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Play", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	ocall = &implJudgePlayClientCall{ClientCall: call}
@@ -608,31 +594,17 @@
 }
 
 // PlayerClient returns a client stub for Player.
-func PlayerClient(name string, opts ...rpc.BindOpt) PlayerClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implPlayerClientStub{name, client}
+func PlayerClient(name string) PlayerClientStub {
+	return implPlayerClientStub{name}
 }
 
 type implPlayerClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implPlayerClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implPlayerClientStub) Challenge(ctx *context.T, i0 string, i1 GameId, i2 GameOptions, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Challenge", []interface{}{i0, i1, i2}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Challenge", []interface{}{i0, i1, i2}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -733,31 +705,17 @@
 }
 
 // ScoreKeeperClient returns a client stub for ScoreKeeper.
-func ScoreKeeperClient(name string, opts ...rpc.BindOpt) ScoreKeeperClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implScoreKeeperClientStub{name, client}
+func ScoreKeeperClient(name string) ScoreKeeperClientStub {
+	return implScoreKeeperClientStub{name}
 }
 
 type implScoreKeeperClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implScoreKeeperClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implScoreKeeperClientStub) Record(ctx *context.T, i0 ScoreCard, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Record", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Record", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -855,32 +813,18 @@
 }
 
 // RockPaperScissorsClient returns a client stub for RockPaperScissors.
-func RockPaperScissorsClient(name string, opts ...rpc.BindOpt) RockPaperScissorsClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implRockPaperScissorsClientStub{name, client, JudgeClient(name, client), PlayerClient(name, client), ScoreKeeperClient(name, client)}
+func RockPaperScissorsClient(name string) RockPaperScissorsClientStub {
+	return implRockPaperScissorsClientStub{name, JudgeClient(name), PlayerClient(name), ScoreKeeperClient(name)}
 }
 
 type implRockPaperScissorsClientStub struct {
-	name   string
-	client rpc.Client
+	name string
 
 	JudgeClientStub
 	PlayerClientStub
 	ScoreKeeperClientStub
 }
 
-func (c implRockPaperScissorsClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
-}
-
 // RockPaperScissorsServerMethods is the interface a server writer
 // implements for RockPaperScissors.
 type RockPaperScissorsServerMethods interface {
diff --git a/examples/tunnel/tunnel.vdl.go b/examples/tunnel/tunnel.vdl.go
index 5023a9e..6fcca58 100644
--- a/examples/tunnel/tunnel.vdl.go
+++ b/examples/tunnel/tunnel.vdl.go
@@ -174,31 +174,17 @@
 }
 
 // TunnelClient returns a client stub for Tunnel.
-func TunnelClient(name string, opts ...rpc.BindOpt) TunnelClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implTunnelClientStub{name, client}
+func TunnelClient(name string) TunnelClientStub {
+	return implTunnelClientStub{name}
 }
 
 type implTunnelClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implTunnelClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implTunnelClientStub) Forward(ctx *context.T, i0 string, i1 string, opts ...rpc.CallOpt) (ocall TunnelForwardClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Forward", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Forward", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	ocall = &implTunnelForwardClientCall{ClientCall: call}
@@ -207,7 +193,7 @@
 
 func (c implTunnelClientStub) Shell(ctx *context.T, i0 string, i1 ShellOpts, opts ...rpc.CallOpt) (ocall TunnelShellClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Shell", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Shell", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	ocall = &implTunnelShellClientCall{ClientCall: call}
diff --git a/examples/tunnel/tunneld/tunneld_v23_test.go b/examples/tunnel/tunneld/tunneld_v23_test.go
index 259ef7b..62ee886 100644
--- a/examples/tunnel/tunneld/tunneld_v23_test.go
+++ b/examples/tunnel/tunneld/tunneld_v23_test.go
@@ -18,14 +18,14 @@
 )
 
 func V23TestTunneld(t *v23tests.T) {
-	v23tests.RunRootMT(t, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(t, "--v23.tcp.address=127.0.0.1:0")
 
 	tunneldBin := t.BuildV23Pkg("v.io/x/ref/examples/tunnel/tunneld")
 	vsh := t.BuildV23Pkg("v.io/x/ref/examples/tunnel/vsh")
 	mounttableBin := t.BuildV23Pkg("v.io/x/ref/cmd/mounttable")
 
 	// Start tunneld with a known endpoint.
-	tunnelEndpoint := tunneldBin.Start("--veyron.tcp.address=127.0.0.1:0").ExpectVar("NAME")
+	tunnelEndpoint := tunneldBin.Start("--v23.tcp.address=127.0.0.1:0").ExpectVar("NAME")
 
 	// Run remote command with the endpoint.
 	if want, got := "HELLO ENDPOINT\n", vsh.Start(tunnelEndpoint, "echo", "HELLO", "ENDPOINT").Output(); want != got {
diff --git a/lib/exec/consts/consts.go b/lib/exec/consts/consts.go
index 254f97c..d6a1f1d 100644
--- a/lib/exec/consts/consts.go
+++ b/lib/exec/consts/consts.go
@@ -13,4 +13,4 @@
 // or ensure that it doesn't appear in a set of environment variables;
 // exposing the name of this variable is intended to support such
 // situations.
-const ExecVersionVariable = "VEYRON_EXEC_VERSION"
+const ExecVersionVariable = "V23_EXEC_VERSION"
diff --git a/lib/flags/flags.go b/lib/flags/flags.go
index bb4d1f9..f28d1dd 100644
--- a/lib/flags/flags.go
+++ b/lib/flags/flags.go
@@ -28,24 +28,26 @@
 const (
 	// Runtime identifies the flags and associated environment variables
 	// used by the Vanadium process runtime. Namely:
-	// --veyron.namespace.root (which may be repeated to supply multiple values)
-	// --veyron.credentials
-	// --veyron.vtrace.sample_rate
-	// --veyron.vtrace.dump_on_shutdown
-	// --veyron.vtrace.cache_size
-	// --veyron.vtrace.collect_regexp
+	// --v23.namespace.root (which may be repeated to supply multiple values)
+	// --v23.credentials
+	// --v23.vtrace.sample-rate
+	// --v23.vtrace.dump-on-shutdown
+	// --v23.vtrace.cache-size
+	// --v23.vtrace.collect-regexp
 	Runtime FlagGroup = iota
 	// Listen identifies the flags typically required to configure
 	// rpc.ListenSpec. Namely:
-	// --veyron.tcp.protocol
-	// --veyron.tcp.address
-	// --veyron.proxy
-	// --vanadium.i18n_catalogue
+	// --v23.tcp.protocol
+	// --v23.tcp.address
+	// --v23.proxy
+	// --v23.i18n-catalogue
 	Listen
-	// --veyron.acl.file (which may be repeated to supply multiple values)
-	// AccessList files are named - i.e. --veyron.acl=<name>:<file> with the
-	// name <runtime> reserved for use by the runtime.
-	// --veyron.acl.literal
+	// --v23.permissions.file (which may be repeated to supply multiple values)
+	// Permissions files are named - i.e. --v23.permissions.file=<name>:<file>
+	// with the name "runtime" reserved for use by the runtime. "file" is
+	// a JSON-encoded representation of the Permissions type defined in the
+	// VDL package v.io/v23/security/access
+	// -v23.permissions.literal
 	AccessList
 )
 
@@ -121,7 +123,7 @@
 // RuntimeFlags contains the values of the Runtime flag group.
 type RuntimeFlags struct {
 	// NamespaceRoots may be initialized by envvar.NamespacePrefix* enivornment
-	// variables as well as --veyron.namespace.root. The command line
+	// variables as well as --v23.namespace.root. The command line
 	// will override the environment.
 	NamespaceRoots []string
 
@@ -272,6 +274,17 @@
 		f.namespaceRootsFlag.roots = roots
 	}
 
+	fs.Var(&f.namespaceRootsFlag, "v23.namespace.root", "local namespace root; can be repeated to provided multiple roots")
+	fs.StringVar(&f.Credentials, "v23.credentials", creds, "directory to use for storing security credentials")
+	fs.StringVar(&f.I18nCatalogue, "v23.i18n-catalogue", i18nCatalogue, "18n catalogue files to load, comma separated")
+
+	fs.Float64Var(&f.Vtrace.SampleRate, "v23.vtrace.sample-rate", 0.0, "Rate (from 0.0 to 1.0) to sample vtrace traces.")
+	fs.BoolVar(&f.Vtrace.DumpOnShutdown, "v23.vtrace.dump-on-shutdown", true, "If true, dump all stored traces on runtime shutdown.")
+	fs.IntVar(&f.Vtrace.CacheSize, "v23.vtrace.cache-size", 1024, "The number of vtrace traces to store in memory.")
+	fs.StringVar(&f.Vtrace.CollectRegexp, "v23.vtrace.collect-regexp", "", "Spans and annotations that match this regular expression will trigger trace collection.")
+
+	// TODO(ashankar): Older names: To be removed:
+	// See: https://github.com/veyron/release-issues/issues/1421
 	fs.Var(&f.namespaceRootsFlag, "veyron.namespace.root", "local namespace root; can be repeated to provided multiple roots")
 	fs.StringVar(&f.Credentials, "veyron.credentials", creds, "directory to use for storing security credentials")
 	fs.StringVar(&f.I18nCatalogue, "vanadium.i18n_catalogue", i18nCatalogue, "18n catalogue files to load, comma separated")
@@ -286,12 +299,16 @@
 
 func createAndRegisterAccessListFlags(fs *flag.FlagSet) *AccessListFlags {
 	f := &AccessListFlags{}
+	fs.Var(&f.fileFlag, "v23.permissions.file", "specify an acl file as <name>:<aclfile>")
+	fs.StringVar(&f.literal, "v23.permissions.literal", "", "explicitly specify the runtime acl as a JSON-encoded access.Permissions. Overrides all --v23.permissions.file flags.")
+	// TODO(ashankar): Older names: To be removed:
+	// See: https://github.com/veyron/release-issues/issues/1421
 	fs.Var(&f.fileFlag, "veyron.acl.file", "specify an acl file as <name>:<aclfile>")
 	fs.StringVar(&f.literal, "veyron.acl.literal", "", "explicitly specify the runtime acl as a JSON-encoded access.Permissions. Overrides all --veyron.acl.file flags.")
 	return f
 }
 
-// SetDefaultProtocol sets the default protocol used when --veyron.tcp.protocol is
+// SetDefaultProtocol sets the default protocol used when --v23.tcp.protocol is
 // not provided. It must be called before flags are parsed for it to take effect.
 func SetDefaultProtocol(protocol string) {
 	listenMu.Lock()
@@ -299,7 +316,7 @@
 	listenMu.Unlock()
 }
 
-// SetDefaultHostPort sets the default host and port used when --veyron.tcp.address
+// SetDefaultHostPort sets the default host and port used when --v23.tcp.address
 // is not provided. It must be called before flags are parsed for it to take effect.
 func SetDefaultHostPort(s string) {
 	listenMu.Lock()
@@ -307,7 +324,7 @@
 	listenMu.Unlock()
 }
 
-// SetDefaultNamespaceRoot sets the default value for --veyron.namespacd.root
+// SetDefaultNamespaceRoot sets the default value for --v23.namespace.root
 func SetDefaultNamespaceRoot(root string) {
 	namespaceMu.Lock()
 	defaultNamespaceRoot = root
@@ -333,6 +350,12 @@
 	}
 	f.addresses.flags = f
 
+	fs.Var(&f.protocol, "v23.tcp.protocol", "protocol to listen with")
+	fs.Var(&f.addresses, "v23.tcp.address", "address to listen on")
+	fs.StringVar(&f.ListenProxy, "v23.proxy", "", "object name of proxy service to use to export services across network boundaries")
+
+	// TODO(ashankar): Older names: To be removed:
+	// See: https://github.com/veyron/release-issues/issues/1421
 	fs.Var(&f.protocol, "veyron.tcp.protocol", "protocol to listen with")
 	fs.Var(&f.addresses, "veyron.tcp.address", "address to listen on")
 	fs.StringVar(&f.ListenProxy, "veyron.proxy", "", "object name of proxy service to use to export services across network boundaries")
diff --git a/lib/flags/flags_test.go b/lib/flags/flags_test.go
index 3de3c4e..d254996 100644
--- a/lib/flags/flags_test.go
+++ b/lib/flags/flags_test.go
@@ -26,7 +26,7 @@
 	}
 	creds := "creddir"
 	roots := []string{"ab:cd:ef"}
-	args := []string{"--veyron.credentials=" + creds, "--veyron.namespace.root=" + roots[0]}
+	args := []string{"--v23.credentials=" + creds, "--v23.namespace.root=" + roots[0]}
 	fl.Parse(args, nil)
 	rtf := fl.RuntimeFlags()
 	if got, want := rtf.NamespaceRoots, roots; !reflect.DeepEqual(got, want) {
@@ -49,7 +49,7 @@
 func TestAccessListFlags(t *testing.T) {
 	fs := flag.NewFlagSet("test", flag.ContinueOnError)
 	fl := flags.CreateAndRegister(fs, flags.Runtime, flags.AccessList)
-	args := []string{"--veyron.acl.file=runtime:foo.json", "--veyron.acl.file=bar:bar.json", "--veyron.acl.file=baz:bar:baz.json"}
+	args := []string{"--v23.permissions.file=runtime:foo.json", "--v23.permissions.file=bar:bar.json", "--v23.permissions.file=baz:bar:baz.json"}
 	fl.Parse(args, nil)
 	aclf := fl.AccessListFlags()
 
@@ -70,7 +70,7 @@
 func TestAccessListLiteralFlags(t *testing.T) {
 	fs := flag.NewFlagSet("test", flag.ContinueOnError)
 	fl := flags.CreateAndRegister(fs, flags.Runtime, flags.AccessList)
-	args := []string{"--veyron.acl.literal=hedgehog"}
+	args := []string{"--v23.permissions.literal=hedgehog"}
 	fl.Parse(args, nil)
 	aclf := fl.AccessListFlags()
 
@@ -85,7 +85,7 @@
 func TestAccessListLiteralBoth(t *testing.T) {
 	fs := flag.NewFlagSet("test", flag.ContinueOnError)
 	fl := flags.CreateAndRegister(fs, flags.Runtime, flags.AccessList)
-	args := []string{"--veyron.acl.file=runtime:foo.json", "--veyron.acl.literal=hedgehog"}
+	args := []string{"--v23.permissions.file=runtime:foo.json", "--v23.permissions.literal=hedgehog"}
 	fl.Parse(args, nil)
 	aclf := fl.AccessListFlags()
 
@@ -102,7 +102,7 @@
 	fs.SetOutput(ioutil.Discard)
 	fl := flags.CreateAndRegister(fs, flags.Runtime)
 	addr := "192.168.10.1:0"
-	args := []string{"--xxxveyron.tcp.address=" + addr, "not an arg"}
+	args := []string{"--xxxv23.tcp.address=" + addr, "not an arg"}
 	err := fl.Parse(args, nil)
 	if err == nil {
 		t.Fatalf("expected this to fail!")
@@ -113,7 +113,7 @@
 
 	fs = flag.NewFlagSet("test", flag.ContinueOnError)
 	fl = flags.CreateAndRegister(fs, flags.AccessList)
-	args = []string{"--veyron.acl.file=noname"}
+	args = []string{"--v23.permissions.file=noname"}
 	err = fl.Parse(args, nil)
 	if err == nil {
 		t.Fatalf("expected this to fail!")
@@ -127,7 +127,7 @@
 	}
 	addr := "192.168.10.1:0"
 	roots := []string{"ab:cd:ef"}
-	args := []string{"--veyron.tcp.address=" + addr, "--veyron.namespace.root=" + roots[0]}
+	args := []string{"--v23.tcp.address=" + addr, "--v23.namespace.root=" + roots[0]}
 	fl.Parse(args, nil)
 	lf := fl.ListenFlags()
 	if got, want := fl.RuntimeFlags().NamespaceRoots, roots; !reflect.DeepEqual(got, want) {
@@ -162,7 +162,7 @@
 		t.Errorf("got %q, want %q", got, want)
 	}
 
-	if err := fl.Parse([]string{"--veyron.credentials=baz"}, nil); err != nil {
+	if err := fl.Parse([]string{"--v23.credentials=baz"}, nil); err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	rtf = fl.RuntimeFlags()
@@ -180,7 +180,7 @@
 	if got, want := rtf.NamespaceRoots, []string{"a:1", "a:2"}; !reflect.DeepEqual(got, want) {
 		t.Errorf("got %q, want %q", got, want)
 	}
-	if err := fl.Parse([]string{"--veyron.namespace.root=b:1", "--veyron.namespace.root=b:2", "--veyron.namespace.root=b:3", "--veyron.credentials=b:4"}, nil); err != nil {
+	if err := fl.Parse([]string{"--v23.namespace.root=b:1", "--v23.namespace.root=b:2", "--v23.namespace.root=b:3", "--v23.credentials=b:4"}, nil); err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	rtf = fl.RuntimeFlags()
@@ -233,10 +233,10 @@
 
 	fl = flags.CreateAndRegister(flag.NewFlagSet("test", flag.ContinueOnError), flags.Listen)
 	if err := fl.Parse([]string{
-		"--veyron.tcp.address=172.0.0.1:10", // Will default to protocol "wsh".
-		"--veyron.tcp.protocol=tcp", "--veyron.tcp.address=127.0.0.10:34",
-		"--veyron.tcp.protocol=ws4", "--veyron.tcp.address=127.0.0.10:44",
-		"--veyron.tcp.protocol=tcp6", "--veyron.tcp.address=172.0.0.100:100"}, nil); err != nil {
+		"--v23.tcp.address=172.0.0.1:10", // Will default to protocol "wsh".
+		"--v23.tcp.protocol=tcp", "--v23.tcp.address=127.0.0.10:34",
+		"--v23.tcp.protocol=ws4", "--v23.tcp.address=127.0.0.10:44",
+		"--v23.tcp.protocol=tcp6", "--v23.tcp.address=172.0.0.100:100"}, nil); err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	lf = fl.ListenFlags()
@@ -258,9 +258,9 @@
 func TestDuplicateFlags(t *testing.T) {
 	fl := flags.CreateAndRegister(flag.NewFlagSet("test", flag.ContinueOnError), flags.Listen)
 	if err := fl.Parse([]string{
-		"--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=172.0.0.1:34",
-		"--veyron.tcp.protocol=tcp", "--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=172.0.0.1:34",
-		"--veyron.tcp.protocol=ws", "--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=172.0.0.1:34", "--veyron.tcp.address=172.0.0.1:34"}, nil); err != nil {
+		"--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=172.0.0.1:34",
+		"--v23.tcp.protocol=tcp", "--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=172.0.0.1:34",
+		"--v23.tcp.protocol=ws", "--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=172.0.0.1:34", "--v23.tcp.address=172.0.0.1:34"}, nil); err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	lf := fl.ListenFlags()
@@ -279,9 +279,9 @@
 		t.Fatalf("got %#v, want %#v", got, want)
 	}
 	if err := fl.Parse([]string{
-		"--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=172.0.0.1:34",
-		"--veyron.tcp.protocol=tcp", "--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=127.0.0.1:34", "--veyron.tcp.address=127.0.0.1:34",
-		"--veyron.tcp.protocol=ws", "--veyron.tcp.address=172.0.0.1:10", "--veyron.tcp.address=127.0.0.1:34", "--veyron.tcp.address=127.0.0.1:34"}, nil); err != nil {
+		"--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=172.0.0.1:34",
+		"--v23.tcp.protocol=tcp", "--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=127.0.0.1:34", "--v23.tcp.address=127.0.0.1:34",
+		"--v23.tcp.protocol=ws", "--v23.tcp.address=172.0.0.1:10", "--v23.tcp.address=127.0.0.1:34", "--v23.tcp.address=127.0.0.1:34"}, nil); err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	if got, want := len(lf.Addrs), 6; got != want {
@@ -293,7 +293,7 @@
 
 	fl = flags.CreateAndRegister(flag.NewFlagSet("test", flag.ContinueOnError), flags.Runtime)
 
-	if err := fl.Parse([]string{"--veyron.namespace.root=ab", "--veyron.namespace.root=xy", "--veyron.namespace.root=ab"}, nil); err != nil {
+	if err := fl.Parse([]string{"--v23.namespace.root=ab", "--v23.namespace.root=xy", "--v23.namespace.root=ab"}, nil); err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 
@@ -313,14 +313,14 @@
 	fs.StringVar(&testFlag2, "test_flag2", "default2", "")
 	fl := flags.CreateAndRegister(fs, flags.Runtime)
 	args := []string{
-		"--veyron.namespace.root=argRoot1",
-		"--veyron.namespace.root=argRoot2",
-		"--veyron.vtrace.cache_size=1234",
+		"--v23.namespace.root=argRoot1",
+		"--v23.namespace.root=argRoot2",
+		"--v23.vtrace.cache-size=1234",
 	}
 	config := map[string]string{
-		"veyron.namespace.root":    "configRoot",
-		"veyron.credentials":       "configCreds",
-		"veyron.vtrace.cache_size": "4321",
+		"v23.namespace.root":       "configRoot",
+		"v23.credentials":          "configCreds",
+		"v23.vtrace.cache-size":    "4321",
 		"test_flag1":               "test value",
 		"flag.that.does.not.exist": "some value",
 	}
@@ -386,7 +386,7 @@
 	fl := flags.CreateAndRegister(fs, flags.Runtime, flags.Listen)
 	nsRoot := "/127.0.1.1:10"
 	hostPort := "127.0.0.1:10"
-	fl.Parse([]string{"--veyron.namespace.root", nsRoot, "--veyron.tcp.address", hostPort}, nil)
+	fl.Parse([]string{"--v23.namespace.root", nsRoot, "--v23.tcp.address", hostPort}, nil)
 	rtf := fl.RuntimeFlags()
 	if got, want := rtf.NamespaceRoots, []string{nsRoot}; !reflect.DeepEqual(got, want) {
 		t.Errorf("got %v, want %v", got, want)
diff --git a/lib/signals/signals_test.go b/lib/signals/signals_test.go
index 431b244..82d5958 100644
--- a/lib/signals/signals_test.go
+++ b/lib/signals/signals_test.go
@@ -19,7 +19,7 @@
 	"v.io/v23/mgmt"
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/appcycle"
+	"v.io/v23/services/appcycle"
 	"v.io/v23/vtrace"
 
 	_ "v.io/x/ref/profiles"
diff --git a/lib/stats/stats.go b/lib/stats/stats.go
index 2bdc961..1ccaf92 100644
--- a/lib/stats/stats.go
+++ b/lib/stats/stats.go
@@ -20,7 +20,7 @@
 	"sync"
 	"time"
 
-	mgmtstats "v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/stats"
 	"v.io/v23/verror"
 )
 
@@ -66,7 +66,7 @@
 		return 0, err
 	}
 	if obj == nil {
-		return nil, verror.New(mgmtstats.ErrNoValue, nil, name)
+		return nil, verror.New(stats.ErrNoValue, nil, name)
 	}
 	return obj.Value(), nil
 }
diff --git a/lib/vdl/codegen/golang/gen.go b/lib/vdl/codegen/golang/gen.go
index e7b3ff5..c4565d9 100644
--- a/lib/vdl/codegen/golang/gen.go
+++ b/lib/vdl/codegen/golang/gen.go
@@ -344,7 +344,7 @@
 		inargs = "[]interface{}{" + argNames("&", "i", "", "", method.InArgs) + "}"
 	}
 	fmt.Fprint(&buf, "\tvar call "+data.Pkg("v.io/v23/rpc")+"ClientCall\n")
-	fmt.Fprintf(&buf, "\tif call, err = c.c(ctx).StartCall(ctx, c.name, %q, %s, opts...); err != nil {\n\t\treturn\n\t}\n", method.Name, inargs)
+	fmt.Fprintf(&buf, "\tif call, err = "+data.Pkg("v.io/v23")+"GetClient(ctx).StartCall(ctx, c.name, %q, %s, opts...); err != nil {\n\t\treturn\n\t}\n", method.Name, inargs)
 	switch {
 	case isStreamingMethod(method):
 		fmt.Fprintf(&buf, "ocall = &%s{ClientCall: call}\n", uniqueNameImpl(iface, method, "ClientCall"))
@@ -477,30 +477,16 @@
 }
 
 // {{$iface.Name}}Client returns a client stub for {{$iface.Name}}.
-func {{$iface.Name}}Client(name string, opts ...{{$rpc_}}BindOpt) {{$iface.Name}}ClientStub {
-	var client {{$rpc_}}Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.({{$rpc_}}Client); ok {
-			client = clientOpt
-		}
-	}
-	return impl{{$iface.Name}}ClientStub{ name, client{{range $embed := $iface.Embeds}}, {{embedGo $data $embed}}Client(name, client){{end}} }
+func {{$iface.Name}}Client(name string) {{$iface.Name}}ClientStub {
+	return impl{{$iface.Name}}ClientStub{name{{range $embed := $iface.Embeds}}, {{embedGo $data $embed}}Client(name){{end}} }
 }
 
 type impl{{$iface.Name}}ClientStub struct {
 	name   string
-	client {{$rpc_}}Client
 {{range $embed := $iface.Embeds}}
 	{{embedGo $data $embed}}ClientStub{{end}}
 }
 
-func (c impl{{$iface.Name}}ClientStub) c({{$ctxArg}}) {{$rpc_}}Client {
-	if c.client != nil {
-		return c.client
-	}
-	return {{$data.Pkg "v.io/v23"}}GetClient(ctx)
-}
-
 {{range $method := $iface.Methods}}
 func (c impl{{$iface.Name}}ClientStub) {{$method.Name}}({{argNameTypes "i" $ctxArg $optsArg $data $method.InArgs}}) {{outArgsClient "o" $data $iface $method}} {
 {{clientStubImpl $data $iface $method}}
diff --git a/lib/vdl/testdata/arith/advanced.vdl.go b/lib/vdl/testdata/arith/advanced.vdl.go
index 537c6d4..40cbc5d 100644
--- a/lib/vdl/testdata/arith/advanced.vdl.go
+++ b/lib/vdl/testdata/arith/advanced.vdl.go
@@ -33,31 +33,17 @@
 }
 
 // TrigonometryClient returns a client stub for Trigonometry.
-func TrigonometryClient(name string, opts ...rpc.BindOpt) TrigonometryClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implTrigonometryClientStub{name, client}
+func TrigonometryClient(name string) TrigonometryClientStub {
+	return implTrigonometryClientStub{name}
 }
 
 type implTrigonometryClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implTrigonometryClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implTrigonometryClientStub) Sine(ctx *context.T, i0 float64, opts ...rpc.CallOpt) (o0 float64, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Sine", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Sine", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -66,7 +52,7 @@
 
 func (c implTrigonometryClientStub) Cosine(ctx *context.T, i0 float64, opts ...rpc.CallOpt) (o0 float64, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Cosine", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Cosine", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -183,31 +169,17 @@
 }
 
 // AdvancedMathClient returns a client stub for AdvancedMath.
-func AdvancedMathClient(name string, opts ...rpc.BindOpt) AdvancedMathClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implAdvancedMathClientStub{name, client, TrigonometryClient(name, client), exp.ExpClient(name, client)}
+func AdvancedMathClient(name string) AdvancedMathClientStub {
+	return implAdvancedMathClientStub{name, TrigonometryClient(name), exp.ExpClient(name)}
 }
 
 type implAdvancedMathClientStub struct {
-	name   string
-	client rpc.Client
+	name string
 
 	TrigonometryClientStub
 	exp.ExpClientStub
 }
 
-func (c implAdvancedMathClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
-}
-
 // AdvancedMathServerMethods is the interface a server writer
 // implements for AdvancedMath.
 //
diff --git a/lib/vdl/testdata/arith/arith.vdl.go b/lib/vdl/testdata/arith/arith.vdl.go
index b4ca2d4..2518ba8 100644
--- a/lib/vdl/testdata/arith/arith.vdl.go
+++ b/lib/vdl/testdata/arith/arith.vdl.go
@@ -100,31 +100,17 @@
 }
 
 // ArithClient returns a client stub for Arith.
-func ArithClient(name string, opts ...rpc.BindOpt) ArithClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implArithClientStub{name, client}
+func ArithClient(name string) ArithClientStub {
+	return implArithClientStub{name}
 }
 
 type implArithClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implArithClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implArithClientStub) Add(ctx *context.T, i0 int32, i1 int32, opts ...rpc.CallOpt) (o0 int32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Add", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Add", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -133,7 +119,7 @@
 
 func (c implArithClientStub) DivMod(ctx *context.T, i0 int32, i1 int32, opts ...rpc.CallOpt) (o0 int32, o1 int32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "DivMod", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "DivMod", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0, &o1)
@@ -142,7 +128,7 @@
 
 func (c implArithClientStub) Sub(ctx *context.T, i0 base.Args, opts ...rpc.CallOpt) (o0 int32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Sub", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Sub", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -151,7 +137,7 @@
 
 func (c implArithClientStub) Mul(ctx *context.T, i0 base.NestedArgs, opts ...rpc.CallOpt) (o0 int32, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Mul", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Mul", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -160,7 +146,7 @@
 
 func (c implArithClientStub) GenError(ctx *context.T, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "GenError", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "GenError", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -169,7 +155,7 @@
 
 func (c implArithClientStub) Count(ctx *context.T, i0 int32, opts ...rpc.CallOpt) (ocall ArithCountClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Count", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Count", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	ocall = &implArithCountClientCall{ClientCall: call}
@@ -178,7 +164,7 @@
 
 func (c implArithClientStub) StreamingAdd(ctx *context.T, opts ...rpc.CallOpt) (ocall ArithStreamingAddClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "StreamingAdd", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "StreamingAdd", nil, opts...); err != nil {
 		return
 	}
 	ocall = &implArithStreamingAddClientCall{ClientCall: call}
@@ -187,7 +173,7 @@
 
 func (c implArithClientStub) QuoteAny(ctx *context.T, i0 *vdl.Value, opts ...rpc.CallOpt) (o0 *vdl.Value, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "QuoteAny", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "QuoteAny", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -723,34 +709,20 @@
 }
 
 // CalculatorClient returns a client stub for Calculator.
-func CalculatorClient(name string, opts ...rpc.BindOpt) CalculatorClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implCalculatorClientStub{name, client, ArithClient(name, client), AdvancedMathClient(name, client)}
+func CalculatorClient(name string) CalculatorClientStub {
+	return implCalculatorClientStub{name, ArithClient(name), AdvancedMathClient(name)}
 }
 
 type implCalculatorClientStub struct {
-	name   string
-	client rpc.Client
+	name string
 
 	ArithClientStub
 	AdvancedMathClientStub
 }
 
-func (c implCalculatorClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
-}
-
 func (c implCalculatorClientStub) On(ctx *context.T, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "On", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "On", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -759,7 +731,7 @@
 
 func (c implCalculatorClientStub) Off(ctx *context.T, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Off", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Off", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
diff --git a/lib/vdl/testdata/arith/exp/exp.vdl.go b/lib/vdl/testdata/arith/exp/exp.vdl.go
index e3eb374..8a4291a 100644
--- a/lib/vdl/testdata/arith/exp/exp.vdl.go
+++ b/lib/vdl/testdata/arith/exp/exp.vdl.go
@@ -29,31 +29,17 @@
 }
 
 // ExpClient returns a client stub for Exp.
-func ExpClient(name string, opts ...rpc.BindOpt) ExpClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implExpClientStub{name, client}
+func ExpClient(name string) ExpClientStub {
+	return implExpClientStub{name}
 }
 
 type implExpClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implExpClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implExpClientStub) Exp(ctx *context.T, i0 float64, opts ...rpc.CallOpt) (o0 float64, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Exp", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Exp", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/lib/vdl/testdata/base/base.vdl.go b/lib/vdl/testdata/base/base.vdl.go
index 1d103d3..678eeeb 100644
--- a/lib/vdl/testdata/base/base.vdl.go
+++ b/lib/vdl/testdata/base/base.vdl.go
@@ -619,31 +619,17 @@
 }
 
 // ServiceAClient returns a client stub for ServiceA.
-func ServiceAClient(name string, opts ...rpc.BindOpt) ServiceAClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implServiceAClientStub{name, client}
+func ServiceAClient(name string) ServiceAClientStub {
+	return implServiceAClientStub{name}
 }
 
 type implServiceAClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implServiceAClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implServiceAClientStub) MethodA1(ctx *context.T, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "MethodA1", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "MethodA1", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -652,7 +638,7 @@
 
 func (c implServiceAClientStub) MethodA2(ctx *context.T, i0 int32, i1 string, opts ...rpc.CallOpt) (o0 string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "MethodA2", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "MethodA2", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -661,7 +647,7 @@
 
 func (c implServiceAClientStub) MethodA3(ctx *context.T, i0 int32, opts ...rpc.CallOpt) (ocall ServiceAMethodA3ClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "MethodA3", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "MethodA3", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	ocall = &implServiceAMethodA3ClientCall{ClientCall: call}
@@ -670,7 +656,7 @@
 
 func (c implServiceAClientStub) MethodA4(ctx *context.T, i0 int32, opts ...rpc.CallOpt) (ocall ServiceAMethodA4ClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "MethodA4", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "MethodA4", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	ocall = &implServiceAMethodA4ClientCall{ClientCall: call}
@@ -1102,33 +1088,19 @@
 }
 
 // ServiceBClient returns a client stub for ServiceB.
-func ServiceBClient(name string, opts ...rpc.BindOpt) ServiceBClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implServiceBClientStub{name, client, ServiceAClient(name, client)}
+func ServiceBClient(name string) ServiceBClientStub {
+	return implServiceBClientStub{name, ServiceAClient(name)}
 }
 
 type implServiceBClientStub struct {
-	name   string
-	client rpc.Client
+	name string
 
 	ServiceAClientStub
 }
 
-func (c implServiceBClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
-}
-
 func (c implServiceBClientStub) MethodB1(ctx *context.T, i0 Scalars, i1 Composites, opts ...rpc.CallOpt) (o0 CompComp, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "MethodB1", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "MethodB1", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/profiles/internal/lib/appcycle/appcycle.go b/profiles/internal/lib/appcycle/appcycle.go
index eb56037..cb67dec 100644
--- a/profiles/internal/lib/appcycle/appcycle.go
+++ b/profiles/internal/lib/appcycle/appcycle.go
@@ -14,7 +14,7 @@
 	"v.io/v23/security"
 	"v.io/x/lib/vlog"
 
-	stub "v.io/v23/services/mgmt/appcycle"
+	public "v.io/v23/services/appcycle"
 )
 
 type AppCycle struct {
@@ -122,10 +122,10 @@
 }
 
 func (m *AppCycle) Remote() interface{} {
-	return stub.AppCycleServer(m.disp)
+	return public.AppCycleServer(m.disp)
 }
 
-func (d *invoker) Stop(call stub.AppCycleStopServerCall) error {
+func (d *invoker) Stop(call public.AppCycleStopServerCall) error {
 	blessings, _ := security.RemoteBlessingNames(call.Context())
 	vlog.Infof("AppCycle Stop request from %v", blessings)
 	// The size of the channel should be reasonably sized to expect not to
@@ -140,7 +140,7 @@
 			// Channel closed, meaning process shutdown is imminent.
 			break
 		}
-		actask := stub.Task{Progress: task.Progress, Goal: task.Goal}
+		actask := public.Task{Progress: task.Progress, Goal: task.Goal}
 		vlog.Infof("AppCycle Stop progress %d/%d", task.Progress, task.Goal)
 		call.SendStream().Send(actask)
 	}
diff --git a/profiles/internal/lib/publisher/publisher.go b/profiles/internal/lib/publisher/publisher.go
index 1121e55..b067f05 100644
--- a/profiles/internal/lib/publisher/publisher.go
+++ b/profiles/internal/lib/publisher/publisher.go
@@ -301,7 +301,7 @@
 	// to sync will occur within the next period, and refresh all mounts.
 	ttl := ps.period + mountTTLSlack
 	status.LastMount = time.Now()
-	status.LastMountErr = ps.ns.Mount(ps.ctx, name, server, ttl, naming.ServesMountTableOpt(attr.servesMT), naming.IsLeafOpt(attr.isLeaf))
+	status.LastMountErr = ps.ns.Mount(ps.ctx, name, server, ttl, naming.ServesMountTable(attr.servesMT), naming.IsLeaf(attr.isLeaf))
 	status.TTL = ttl
 	if status.LastMountErr != nil {
 		vlog.Errorf("rpc pub: couldn't mount(%v, %v, %v): %v", name, server, ttl, status.LastMountErr)
diff --git a/profiles/internal/lib/websocket/hybrid.go b/profiles/internal/lib/websocket/hybrid.go
index d35c7d5..9e4e52a 100644
--- a/profiles/internal/lib/websocket/hybrid.go
+++ b/profiles/internal/lib/websocket/hybrid.go
@@ -32,7 +32,7 @@
 
 // HybridListener returns a net.Listener that supports both tcp and
 // websockets over the same, single, port. A listen address of
-// --veyron.tcp.protocol=wsh --veyron.tcp.address=127.0.0.1:8101 means
+// --v23.tcp.protocol=wsh --v23.tcp.address=127.0.0.1:8101 means
 // that port 8101 can accept connections that use either tcp or websocket.
 // The listener looks at the first 4 bytes of the incoming data stream
 // to decide if it's a websocket protocol or not. These must be 'GET ' for
diff --git a/profiles/internal/naming/endpoint_test.go b/profiles/internal/naming/endpoint_test.go
index 1cd985e..a011512 100644
--- a/profiles/internal/naming/endpoint_test.go
+++ b/profiles/internal/naming/endpoint_test.go
@@ -163,7 +163,7 @@
 		} else {
 			ep, err = NewEndpoint(naming.FormatEndpoint(naming.UnknownProtocol, str,
 				version.RPCVersionRange{test.min, test.max},
-				naming.ServesMountTableOpt(test.servesMT)))
+				naming.ServesMountTable(test.servesMT)))
 		}
 		if err != nil {
 			t.Errorf("Endpoint(%q) failed with %v", str, err)
diff --git a/profiles/internal/naming/namespace/acl.go b/profiles/internal/naming/namespace/acl.go
index 61f6a0d..d47e4ea 100644
--- a/profiles/internal/naming/namespace/acl.go
+++ b/profiles/internal/naming/namespace/acl.go
@@ -7,6 +7,7 @@
 import (
 	"v.io/v23"
 	"v.io/v23/context"
+	"v.io/v23/naming"
 	"v.io/v23/options"
 	"v.io/v23/rpc"
 	"v.io/v23/security/access"
@@ -14,10 +15,10 @@
 )
 
 // setAccessListInMountTable sets the AccessList in a single server.
-func setAccessListInMountTable(ctx *context.T, client rpc.Client, name string, acl access.Permissions, etag, id string) (s status) {
+func setAccessListInMountTable(ctx *context.T, client rpc.Client, name string, acl access.Permissions, etag, id string, opts []rpc.CallOpt) (s status) {
 	s.id = id
 	ctx, _ = context.WithTimeout(ctx, callTimeout)
-	call, err := client.StartCall(ctx, name, "SetPermissions", []interface{}{acl, etag}, options.NoResolve{})
+	call, err := client.StartCall(ctx, name, "SetPermissions", []interface{}{acl, etag}, append(opts, options.NoResolve{})...)
 	s.err = err
 	if err != nil {
 		return
@@ -26,33 +27,33 @@
 	return
 }
 
-func (ns *namespace) SetPermissions(ctx *context.T, name string, acl access.Permissions, etag string) error {
+func (ns *namespace) SetPermissions(ctx *context.T, name string, acl access.Permissions, etag string, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 	client := v23.GetClient(ctx)
 
 	// Apply to all mount tables implementing the name.
 	f := func(ctx *context.T, mt, id string) status {
-		return setAccessListInMountTable(ctx, client, mt, acl, etag, id)
+		return setAccessListInMountTable(ctx, client, mt, acl, etag, id, getCallOpts(opts))
 	}
-	err := ns.dispatch(ctx, name, f)
+	err := ns.dispatch(ctx, name, f, opts)
 	vlog.VI(1).Infof("SetPermissions(%s, %v, %s) -> %v", name, acl, etag, err)
 	return err
 }
 
 // GetPermissions gets an AccessList from a mount table.
-func (ns *namespace) GetPermissions(ctx *context.T, name string) (acl access.Permissions, etag string, err error) {
+func (ns *namespace) GetPermissions(ctx *context.T, name string, opts ...naming.NamespaceOpt) (acl access.Permissions, etag string, err error) {
 	defer vlog.LogCall()()
 	client := v23.GetClient(ctx)
 
 	// Resolve to all the mount tables implementing name.
-	me, rerr := ns.ResolveToMountTable(ctx, name)
+	me, rerr := ns.ResolveToMountTable(ctx, name, opts...)
 	if rerr != nil {
 		err = rerr
 		return
 	}
 	mts := me.Names()
 
-	call, serr := ns.parallelStartCall(ctx, client, mts, "GetPermissions", []interface{}{})
+	call, serr := ns.parallelStartCall(ctx, client, mts, "GetPermissions", []interface{}{}, getCallOpts(opts))
 	if serr != nil {
 		err = serr
 		return
diff --git a/profiles/internal/naming/namespace/acl_test.go b/profiles/internal/naming/namespace/acl_test.go
index d64b009..74e60c2 100644
--- a/profiles/internal/naming/namespace/acl_test.go
+++ b/profiles/internal/naming/namespace/acl_test.go
@@ -129,10 +129,10 @@
 	defer stop2()
 
 	// Mount them into the root.
-	if err := ns.Mount(rootCtx, "a/b/c", mt1Addr, 0, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(rootCtx, "a/b/c", mt1Addr, 0, naming.ServesMountTable(true)); err != nil {
 		t.Fatalf("Failed to Mount %s onto a/b/c: %s", "/"+mt1Addr, err)
 	}
-	if err := ns.Mount(rootCtx, "a/b/c", mt2Addr, 0, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(rootCtx, "a/b/c", mt2Addr, 0, naming.ServesMountTable(true)); err != nil {
 		t.Fatalf("Failed to Mount %s onto a/b/c: %s", "/"+mt2Addr, err)
 	}
 
diff --git a/profiles/internal/naming/namespace/all_test.go b/profiles/internal/naming/namespace/all_test.go
index 6437661..af205c2 100644
--- a/profiles/internal/naming/namespace/all_test.go
+++ b/profiles/internal/naming/namespace/all_test.go
@@ -148,7 +148,7 @@
 	}
 }
 
-func doResolveTest(t *testing.T, fname string, f func(*context.T, string, ...naming.ResolveOpt) (*naming.MountEntry, error), ctx *context.T, name string, want []string, opts ...naming.ResolveOpt) {
+func doResolveTest(t *testing.T, fname string, f func(*context.T, string, ...naming.NamespaceOpt) (*naming.MountEntry, error), ctx *context.T, name string, want []string, opts ...naming.NamespaceOpt) {
 	me, err := f(ctx, name, opts...)
 	if err != nil {
 		boom(t, "Failed to %s %s: %s", fname, name, err)
@@ -160,7 +160,7 @@
 	doResolveTest(t, "ResolveToMountTable", ns.ResolveToMountTable, ctx, name, want)
 }
 
-func testResolveToMountTableWithPattern(t *testing.T, ctx *context.T, ns ns.Namespace, name string, pattern naming.ResolveOpt, want ...string) {
+func testResolveToMountTableWithPattern(t *testing.T, ctx *context.T, ns ns.Namespace, name string, pattern naming.NamespaceOpt, want ...string) {
 	doResolveTest(t, "ResolveToMountTable", ns.ResolveToMountTable, ctx, name, want, pattern)
 }
 
@@ -168,7 +168,7 @@
 	doResolveTest(t, "Resolve", ns.Resolve, ctx, name, want)
 }
 
-func testResolveWithPattern(t *testing.T, ctx *context.T, ns ns.Namespace, name string, pattern naming.ResolveOpt, want ...string) {
+func testResolveWithPattern(t *testing.T, ctx *context.T, ns ns.Namespace, name string, pattern naming.NamespaceOpt, want ...string) {
 	doResolveTest(t, "Resolve", ns.Resolve, ctx, name, want, pattern)
 }
 
@@ -352,7 +352,7 @@
 		{"mt2", mts[mt4MP].name},
 		{"mt2//", mts[mt5MP].name},
 	} {
-		if err := ns.Mount(c, mp.name, mp.server, ttl, naming.ServesMountTableOpt(true)); err != nil {
+		if err := ns.Mount(c, mp.name, mp.server, ttl, naming.ServesMountTable(true)); err != nil {
 			boom(t, "Failed to Mount %s: %s", mp.name, err)
 		}
 	}
@@ -546,17 +546,17 @@
 	defer c3.server.Stop()
 
 	m := "c1/c2"
-	if err := ns.Mount(c, m, c1.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(c, m, c1.name, ttl, naming.ServesMountTable(true)); err != nil {
 		boom(t, "Failed to Mount %s: %s", "c1/c2", err)
 	}
 
 	m = "c1/c2/c3"
-	if err := ns.Mount(c, m, c3.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(c, m, c3.name, ttl, naming.ServesMountTable(true)); err != nil {
 		boom(t, "Failed to Mount %s: %s", m, err)
 	}
 
 	m = "c1/c3/c4"
-	if err := ns.Mount(c, m, c1.name, ttl, naming.ServesMountTableOpt(true)); err != nil {
+	if err := ns.Mount(c, m, c1.name, ttl, naming.ServesMountTable(true)); err != nil {
 		boom(t, "Failed to Mount %s: %s", m, err)
 	}
 
@@ -628,11 +628,11 @@
 		idp            = testutil.NewIDProvider("idp")                  // identity provider
 		serverEndpoint = naming.FormatEndpoint("tcp", "127.0.0.1:14141")
 
-		resolve = func(name string, opts ...naming.ResolveOpt) (*naming.MountEntry, error) {
+		resolve = func(name string, opts ...naming.NamespaceOpt) (*naming.MountEntry, error) {
 			return v23.GetNamespace(clientCtx).Resolve(clientCtx, name, opts...)
 		}
 
-		mount = func(name, server string, ttl time.Duration, opts ...naming.MountOpt) error {
+		mount = func(name, server string, ttl time.Duration, opts ...naming.NamespaceOpt) error {
 			return v23.GetNamespace(serverCtx).Mount(serverCtx, name, server, ttl, opts...)
 		}
 	)
@@ -654,7 +654,7 @@
 	// Intermediate mounttables should be authenticated.
 	mt := runMT(t, mtCtx, "mt")
 	// Mount a server on "mt".
-	if err := mount("mt/server", serverEndpoint, time.Minute, naming.ReplaceMountOpt(true)); err != nil {
+	if err := mount("mt/server", serverEndpoint, time.Minute, naming.ReplaceMount(true)); err != nil {
 		t.Error(err)
 	}
 	// The namespace root should be authenticated too
@@ -664,7 +664,7 @@
 		// Host:Port and Endpoint versions of the other namespace root
 		// (which has different blessings)
 		hproot := fmt.Sprintf("(otherroot)@%v", rootmt.endpoint.Addr())
-		eproot := naming.FormatEndpoint(rootmt.endpoint.Addr().Network(), rootmt.endpoint.Addr().String(), rootmt.endpoint.RoutingID(), naming.BlessingOpt("otherroot"), naming.ServesMountTableOpt(rootmt.endpoint.ServesMountTable()))
+		eproot := naming.FormatEndpoint(rootmt.endpoint.Addr().Network(), rootmt.endpoint.Addr().String(), rootmt.endpoint.RoutingID(), naming.BlessingOpt("otherroot"), naming.ServesMountTable(rootmt.endpoint.ServesMountTable()))
 		for _, root := range []string{hproot, eproot} {
 			name := naming.JoinAddressName(root, "mt")
 			// Rooted name resolutions should fail authorization because of the "otherrot"
@@ -691,7 +691,7 @@
 	// global mounttable) having inconsistent blessings. Simulate this by
 	// explicitly changing the mount entry for "mt".
 	goodChildMTEndpoint := naming.FormatEndpoint(mt.endpoint.Addr().Network(), mt.endpoint.Addr().String(), naming.BlessingOpt("idp/goodchildmt"), mt.endpoint.RoutingID())
-	if err := v23.GetNamespace(mtCtx).Mount(mtCtx, "mt", goodChildMTEndpoint, time.Minute, naming.ServesMountTableOpt(true), naming.ReplaceMountOpt(true)); err != nil {
+	if err := v23.GetNamespace(mtCtx).Mount(mtCtx, "mt", goodChildMTEndpoint, time.Minute, naming.ServesMountTable(true), naming.ReplaceMount(true)); err != nil {
 		t.Error(err)
 	}
 
diff --git a/profiles/internal/naming/namespace/glob.go b/profiles/internal/naming/namespace/glob.go
index 4be55cc..f3c30b8 100644
--- a/profiles/internal/naming/namespace/glob.go
+++ b/profiles/internal/naming/namespace/glob.go
@@ -50,7 +50,7 @@
 
 // globAtServer performs a Glob on the servers at a mount point.  It cycles through the set of
 // servers until it finds one that replies.
-func (ns *namespace) globAtServer(ctx *context.T, t *task, replies chan *task, tr *tracks) {
+func (ns *namespace) globAtServer(ctx *context.T, t *task, replies chan *task, tr *tracks, opts []rpc.CallOpt) {
 	defer func() {
 		if t.error == nil {
 			replies <- nil
@@ -80,7 +80,7 @@
 		return
 	}
 
-	call, err := ns.parallelStartCall(ctx, client, servers, rpc.GlobMethod, []interface{}{pstr})
+	call, err := ns.parallelStartCall(ctx, client, servers, rpc.GlobMethod, []interface{}{pstr}, opts)
 	if err != nil {
 		t.error = err
 		return
@@ -147,7 +147,7 @@
 }
 
 // globLoop fires off a go routine for each server and read backs replies.
-func (ns *namespace) globLoop(ctx *context.T, e *naming.MountEntry, prefix string, pattern *glob.Glob, reply chan interface{}, tr *tracks) {
+func (ns *namespace) globLoop(ctx *context.T, e *naming.MountEntry, prefix string, pattern *glob.Glob, reply chan interface{}, tr *tracks, opts []rpc.CallOpt) {
 	defer close(reply)
 
 	// Provide enough buffers to avoid too much switching between the readers and the writers.
@@ -229,13 +229,13 @@
 			// Perform a glob at the next server.
 			inFlight++
 			t.pattern = suffix
-			go ns.globAtServer(ctx, t, replies, tr)
+			go ns.globAtServer(ctx, t, replies, tr, opts)
 		}
 	}
 }
 
 // Glob implements naming.MountTable.Glob.
-func (ns *namespace) Glob(ctx *context.T, pattern string) (chan interface{}, error) {
+func (ns *namespace) Glob(ctx *context.T, pattern string, opts ...naming.NamespaceOpt) (chan interface{}, error) {
 	defer vlog.LogCall()()
 	// Root the pattern.  If we have no servers to query, give up.
 	e, patternWasRooted := ns.rootMountEntry(pattern)
@@ -260,6 +260,6 @@
 	}
 	e.Name = ""
 	reply := make(chan interface{}, 100)
-	go ns.globLoop(ctx, e, prefix, g, reply, tr)
+	go ns.globLoop(ctx, e, prefix, g, reply, tr, getCallOpts(opts))
 	return reply, nil
 }
diff --git a/profiles/internal/naming/namespace/mount.go b/profiles/internal/naming/namespace/mount.go
index 7c28c28..6e9d87b 100644
--- a/profiles/internal/naming/namespace/mount.go
+++ b/profiles/internal/naming/namespace/mount.go
@@ -17,10 +17,10 @@
 )
 
 // mountIntoMountTable mounts a single server into a single mount table.
-func mountIntoMountTable(ctx *context.T, client rpc.Client, name, server string, ttl time.Duration, flags naming.MountFlag, id string) (s status) {
+func mountIntoMountTable(ctx *context.T, client rpc.Client, name, server string, ttl time.Duration, flags naming.MountFlag, id string, opts ...rpc.CallOpt) (s status) {
 	s.id = id
 	ctx, _ = context.WithTimeout(ctx, callTimeout)
-	call, err := client.StartCall(ctx, name, "Mount", []interface{}{server, uint32(ttl.Seconds()), flags}, options.NoResolve{})
+	call, err := client.StartCall(ctx, name, "Mount", []interface{}{server, uint32(ttl.Seconds()), flags}, append(opts, options.NoResolve{})...)
 	s.err = err
 	if err != nil {
 		return
@@ -30,22 +30,22 @@
 }
 
 // Mount implements Namespace.Mount.
-func (ns *namespace) Mount(ctx *context.T, name, server string, ttl time.Duration, opts ...naming.MountOpt) error {
+func (ns *namespace) Mount(ctx *context.T, name, server string, ttl time.Duration, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 
 	var flags naming.MountFlag
 	for _, o := range opts {
 		// NB: used a switch since we'll be adding more options.
 		switch v := o.(type) {
-		case naming.ReplaceMountOpt:
+		case naming.ReplaceMount:
 			if v {
 				flags |= naming.MountFlag(naming.Replace)
 			}
-		case naming.ServesMountTableOpt:
+		case naming.ServesMountTable:
 			if v {
 				flags |= naming.MountFlag(naming.MT)
 			}
-		case naming.IsLeafOpt:
+		case naming.IsLeaf:
 			if v {
 				flags |= naming.MountFlag(naming.Leaf)
 			}
@@ -55,18 +55,18 @@
 	client := v23.GetClient(ctx)
 	// Mount the server in all the returned mount tables.
 	f := func(ctx *context.T, mt, id string) status {
-		return mountIntoMountTable(ctx, client, mt, server, ttl, flags, id)
+		return mountIntoMountTable(ctx, client, mt, server, ttl, flags, id, getCallOpts(opts)...)
 	}
-	err := ns.dispatch(ctx, name, f)
+	err := ns.dispatch(ctx, name, f, opts)
 	vlog.VI(1).Infof("Mount(%s, %q) -> %v", name, server, err)
 	return err
 }
 
 // unmountFromMountTable removes a single mounted server from a single mount table.
-func unmountFromMountTable(ctx *context.T, client rpc.Client, name, server string, id string) (s status) {
+func unmountFromMountTable(ctx *context.T, client rpc.Client, name, server string, id string, opts ...rpc.CallOpt) (s status) {
 	s.id = id
 	ctx, _ = context.WithTimeout(ctx, callTimeout)
-	call, err := client.StartCall(ctx, name, "Unmount", []interface{}{server}, options.NoResolve{})
+	call, err := client.StartCall(ctx, name, "Unmount", []interface{}{server}, append(opts, options.NoResolve{})...)
 	s.err = err
 	if err != nil {
 		return
@@ -76,24 +76,24 @@
 }
 
 // Unmount implements Namespace.Unmount.
-func (ns *namespace) Unmount(ctx *context.T, name, server string) error {
+func (ns *namespace) Unmount(ctx *context.T, name, server string, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 	// Unmount the server from all the mount tables.
 	client := v23.GetClient(ctx)
 	f := func(ctx *context.T, mt, id string) status {
-		return unmountFromMountTable(ctx, client, mt, server, id)
+		return unmountFromMountTable(ctx, client, mt, server, id, getCallOpts(opts)...)
 	}
-	err := ns.dispatch(ctx, name, f)
+	err := ns.dispatch(ctx, name, f, opts)
 	vlog.VI(1).Infof("Unmount(%s, %s) -> %v", name, server, err)
 	return err
 }
 
 // deleteFromMountTable deletes a name from a single mount table.  If there are any children
 // and deleteSubtree isn't true, nothing is deleted.
-func deleteFromMountTable(ctx *context.T, client rpc.Client, name string, deleteSubtree bool, id string) (s status) {
+func deleteFromMountTable(ctx *context.T, client rpc.Client, name string, deleteSubtree bool, id string, opts ...rpc.CallOpt) (s status) {
 	s.id = id
 	ctx, _ = context.WithTimeout(ctx, callTimeout)
-	call, err := client.StartCall(ctx, name, "Delete", []interface{}{deleteSubtree}, options.NoResolve{})
+	call, err := client.StartCall(ctx, name, "Delete", []interface{}{deleteSubtree}, append(opts, options.NoResolve{})...)
 	s.err = err
 	if err != nil {
 		return
@@ -103,14 +103,14 @@
 }
 
 // RDeleteemove implements Namespace.Delete.
-func (ns *namespace) Delete(ctx *context.T, name string, deleteSubtree bool) error {
+func (ns *namespace) Delete(ctx *context.T, name string, deleteSubtree bool, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 	// Remove from all the mount tables.
 	client := v23.GetClient(ctx)
 	f := func(ctx *context.T, mt, id string) status {
-		return deleteFromMountTable(ctx, client, mt, deleteSubtree, id)
+		return deleteFromMountTable(ctx, client, mt, deleteSubtree, id, getCallOpts(opts)...)
 	}
-	err := ns.dispatch(ctx, name, f)
+	err := ns.dispatch(ctx, name, f, opts)
 	vlog.VI(1).Infof("Remove(%s, %v) -> %v", name, deleteSubtree, err)
 	return err
 }
diff --git a/profiles/internal/naming/namespace/namespace.go b/profiles/internal/naming/namespace/namespace.go
index 8d652a9..13311bd 100644
--- a/profiles/internal/naming/namespace/namespace.go
+++ b/profiles/internal/naming/namespace/namespace.go
@@ -11,6 +11,7 @@
 	inaming "v.io/x/ref/profiles/internal/naming"
 
 	"v.io/v23/naming"
+	"v.io/v23/rpc"
 	"v.io/v23/security"
 	vdltime "v.io/v23/vdlroot/time"
 	"v.io/v23/verror"
@@ -126,7 +127,7 @@
 // (1) MountEntry
 // (2) Whether "name" is a rooted name or not (if not, the namespace roots
 //     configured in "ns" will be used).
-func (ns *namespace) rootMountEntry(name string, opts ...naming.ResolveOpt) (*naming.MountEntry, bool) {
+func (ns *namespace) rootMountEntry(name string, opts ...naming.NamespaceOpt) (*naming.MountEntry, bool) {
 	_, name = security.SplitPatternName(naming.Clean(name))
 	e := new(naming.MountEntry)
 	deadline := vdltime.Deadline{time.Now().Add(time.Hour)} // plenty of time for a call
@@ -198,3 +199,13 @@
 	}
 	return nil
 }
+
+func getCallOpts(opts []naming.NamespaceOpt) []rpc.CallOpt {
+	var out []rpc.CallOpt
+	for _, o := range opts {
+		if co, ok := o.(rpc.CallOpt); ok {
+			out = append(out, co)
+		}
+	}
+	return out
+}
diff --git a/profiles/internal/naming/namespace/parallelstartcall.go b/profiles/internal/naming/namespace/parallelstartcall.go
index 611d742..f753e4e 100644
--- a/profiles/internal/naming/namespace/parallelstartcall.go
+++ b/profiles/internal/naming/namespace/parallelstartcall.go
@@ -19,13 +19,13 @@
 	call  rpc.ClientCall
 }
 
-func tryStartCall(ctx *context.T, client rpc.Client, target, method string, args []interface{}, c chan startStatus, index int) {
-	call, err := client.StartCall(ctx, target, method, args, options.NoResolve{})
+func tryStartCall(ctx *context.T, client rpc.Client, target, method string, args []interface{}, c chan startStatus, index int, opts ...rpc.CallOpt) {
+	call, err := client.StartCall(ctx, target, method, args, append(opts, options.NoResolve{})...)
 	c <- startStatus{index: index, err: err, call: call}
 }
 
 // parallelStartCall returns the first succeeding StartCall.
-func (ns *namespace) parallelStartCall(ctx *context.T, client rpc.Client, servers []string, method string, args []interface{}) (rpc.ClientCall, error) {
+func (ns *namespace) parallelStartCall(ctx *context.T, client rpc.Client, servers []string, method string, args []interface{}, opts []rpc.CallOpt) (rpc.ClientCall, error) {
 	if len(servers) == 0 {
 		return nil, verror.New(verror.ErrNoExist, ctx, "no servers to resolve query")
 	}
@@ -36,7 +36,7 @@
 	for index, server := range servers {
 		callCtx, cancel := context.WithTimeout(ctx, callTimeout)
 		cancelFuncs[index] = cancel
-		go tryStartCall(callCtx, client, server, method, args, c, index)
+		go tryStartCall(callCtx, client, server, method, args, c, index, opts...)
 	}
 
 	// First positive response wins.  Cancel the rest.  The cancellation
@@ -101,7 +101,7 @@
 }
 
 // dispatch executes f in parallel for each mount table implementing mTName.
-func (ns *namespace) dispatch(ctx *context.T, mTName string, f func(*context.T, string, string) status, opts ...naming.ResolveOpt) error {
+func (ns *namespace) dispatch(ctx *context.T, mTName string, f func(*context.T, string, string) status, opts []naming.NamespaceOpt) error {
 	// Resolve to all the mount tables implementing name.
 	me, err := ns.ResolveToMountTable(ctx, mTName, opts...)
 	if err != nil {
diff --git a/profiles/internal/naming/namespace/resolve.go b/profiles/internal/naming/namespace/resolve.go
index e38df59..a813577 100644
--- a/profiles/internal/naming/namespace/resolve.go
+++ b/profiles/internal/naming/namespace/resolve.go
@@ -65,7 +65,7 @@
 }
 
 // Resolve implements v.io/v23/naming.Namespace.
-func (ns *namespace) Resolve(ctx *context.T, name string, opts ...naming.ResolveOpt) (*naming.MountEntry, error) {
+func (ns *namespace) Resolve(ctx *context.T, name string, opts ...naming.NamespaceOpt) (*naming.MountEntry, error) {
 	defer vlog.LogCall()()
 	e, _ := ns.rootMountEntry(name, opts...)
 	if vlog.V(2) {
@@ -109,7 +109,7 @@
 }
 
 // ResolveToMountTable implements v.io/v23/naming.Namespace.
-func (ns *namespace) ResolveToMountTable(ctx *context.T, name string, opts ...naming.ResolveOpt) (*naming.MountEntry, error) {
+func (ns *namespace) ResolveToMountTable(ctx *context.T, name string, opts ...naming.NamespaceOpt) (*naming.MountEntry, error) {
 	defer vlog.LogCall()()
 	e, _ := ns.rootMountEntry(name, opts...)
 	if vlog.V(2) {
@@ -182,7 +182,7 @@
 	return flushed
 }
 
-func skipResolve(opts []naming.ResolveOpt) bool {
+func skipResolve(opts []naming.NamespaceOpt) bool {
 	for _, o := range opts {
 		if _, ok := o.(options.NoResolve); ok {
 			return true
@@ -190,13 +190,3 @@
 	}
 	return false
 }
-
-func getCallOpts(opts []naming.ResolveOpt) []rpc.CallOpt {
-	var out []rpc.CallOpt
-	for _, o := range opts {
-		if co, ok := o.(rpc.CallOpt); ok {
-			out = append(out, co)
-		}
-	}
-	return out
-}
diff --git a/profiles/internal/rpc/benchmark/README.txt b/profiles/internal/rpc/benchmark/README.txt
index 5b511f0..27fa43b 100644
--- a/profiles/internal/rpc/benchmark/README.txt
+++ b/profiles/internal/rpc/benchmark/README.txt
@@ -53,7 +53,7 @@
 the first RPC.
 
 $ v23 go run benchmarkd/main.go \
-  -veyron.tcp.address=localhost:8888 -veyron.acl.literal='{"Read": {"In": ["..."]}}'
+  -v23.tcp.address=localhost:8888 -v23.permissions.literal='{"Read": {"In": ["..."]}}'
 
 (In a different shell)
 $ v23 go run benchmark/main.go \
@@ -112,7 +112,7 @@
 about 22 ms, and streaming many 1 KB chunks takes about 6.5 ms per chunk.
 
 
-$ ./benchmarkd --address=localhost:8888 --veyron.acl.literal='{"...":"A"}'
+$ ./benchmarkd --address=localhost:8888 --v23.permissions.literal='{"...":"A"}'
 
 $ ./benchmark --server=/localhost:8888 --count=10 --payload_size=1000
 CallEcho 0 2573406000
diff --git a/profiles/internal/rpc/benchmark/benchmark.vdl.go b/profiles/internal/rpc/benchmark/benchmark.vdl.go
index 84e7d4f..5412fb6 100644
--- a/profiles/internal/rpc/benchmark/benchmark.vdl.go
+++ b/profiles/internal/rpc/benchmark/benchmark.vdl.go
@@ -37,31 +37,17 @@
 }
 
 // BenchmarkClient returns a client stub for Benchmark.
-func BenchmarkClient(name string, opts ...rpc.BindOpt) BenchmarkClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implBenchmarkClientStub{name, client}
+func BenchmarkClient(name string) BenchmarkClientStub {
+	return implBenchmarkClientStub{name}
 }
 
 type implBenchmarkClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implBenchmarkClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implBenchmarkClientStub) Echo(ctx *context.T, i0 []byte, opts ...rpc.CallOpt) (o0 []byte, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Echo", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Echo", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -70,7 +56,7 @@
 
 func (c implBenchmarkClientStub) EchoStream(ctx *context.T, opts ...rpc.CallOpt) (ocall BenchmarkEchoStreamClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "EchoStream", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "EchoStream", nil, opts...); err != nil {
 		return
 	}
 	ocall = &implBenchmarkEchoStreamClientCall{ClientCall: call}
diff --git a/profiles/internal/rpc/client.go b/profiles/internal/rpc/client.go
index 9905f55..3586fcf 100644
--- a/profiles/internal/rpc/client.go
+++ b/profiles/internal/rpc/client.go
@@ -7,7 +7,6 @@
 import (
 	"fmt"
 	"io"
-	"math"
 	"math/rand"
 	"net"
 	"reflect"
@@ -185,9 +184,10 @@
 }
 
 // A randomized exponential backoff. The randomness deters error convoys
-// from forming.
-func backoff(n int, deadline time.Time) bool {
-	b := time.Duration(math.Pow(1.5+(rand.Float64()/2.0), float64(n)) * float64(time.Second))
+// from forming.  The first time you retry n should be 0, then 1 etc.
+func backoff(n uint, deadline time.Time) bool {
+	// This is ((100 to 200) * 2^n) ms.
+	b := time.Duration((100+rand.Intn(100))<<n) * time.Millisecond
 	if b > maxBackoff {
 		b = maxBackoff
 	}
@@ -254,12 +254,7 @@
 	}
 
 	var lastErr error
-	for retries := 0; ; retries++ {
-		if retries != 0 {
-			if !backoff(retries, deadline) {
-				break
-			}
-		}
+	for retries := uint(0); ; retries++ {
 		call, action, err := c.tryCall(ctx, name, method, args, opts)
 		if err == nil {
 			return call, nil
@@ -273,7 +268,7 @@
 			shouldRetry = false
 		case time.Now().After(deadline):
 			shouldRetry = false
-		case action == verror.RetryRefetch && getNoResolveOpt(opts):
+		case action == verror.RetryRefetch && getNoNamespaceOpt(opts):
 			// If we're skipping resolution and there are no servers for
 			// this call retrying is not going to help, we can't come up
 			// with new servers if there is no resolution.
@@ -284,6 +279,9 @@
 			break
 		}
 		span.Annotatef("Retrying due to error: %s", err)
+		if !backoff(retries, deadline) {
+			break
+		}
 	}
 	return nil, lastErr
 }
@@ -373,7 +371,7 @@
 	var err error
 	var blessingPattern security.BlessingPattern
 	blessingPattern, name = security.SplitPatternName(name)
-	if resolved, err = c.ns.Resolve(ctx, name, getResolveOpts(opts)...); err != nil {
+	if resolved, err = c.ns.Resolve(ctx, name, getNamespaceOpts(opts)...); err != nil {
 		vlog.Errorf("Resolve: %v", err)
 		// We always return NoServers as the error so that the caller knows
 		// that's ok to retry the operation since the name may be registered
diff --git a/profiles/internal/rpc/discharges.go b/profiles/internal/rpc/discharges.go
index cb832ea..60ef4bc 100644
--- a/profiles/internal/rpc/discharges.go
+++ b/profiles/internal/rpc/discharges.go
@@ -23,8 +23,8 @@
 // NoDischarges specifies that the RPC call should not fetch discharges.
 type NoDischarges struct{}
 
-func (NoDischarges) RPCCallOpt()   {}
-func (NoDischarges) NSResolveOpt() {}
+func (NoDischarges) RPCCallOpt() {}
+func (NoDischarges) NSOpt()      {}
 
 // discharger implements vc.DischargeClient.
 type dischargeClient struct {
diff --git a/profiles/internal/rpc/options.go b/profiles/internal/rpc/options.go
index 3ff7109..27a6fe1 100644
--- a/profiles/internal/rpc/options.go
+++ b/profiles/internal/rpc/options.go
@@ -44,7 +44,7 @@
 	return 0, false
 }
 
-func getNoResolveOpt(opts []rpc.CallOpt) bool {
+func getNoNamespaceOpt(opts []rpc.CallOpt) bool {
 	for _, o := range opts {
 		if _, ok := o.(options.NoResolve); ok {
 			return true
@@ -80,9 +80,9 @@
 	return
 }
 
-func getResolveOpts(opts []rpc.CallOpt) (resolveOpts []naming.ResolveOpt) {
+func getNamespaceOpts(opts []rpc.CallOpt) (resolveOpts []naming.NamespaceOpt) {
 	for _, o := range opts {
-		if r, ok := o.(naming.ResolveOpt); ok {
+		if r, ok := o.(naming.NamespaceOpt); ok {
 			resolveOpts = append(resolveOpts, r)
 		}
 	}
diff --git a/profiles/internal/rpc/stress/stress.vdl.go b/profiles/internal/rpc/stress/stress.vdl.go
index 100df93..ed9011f 100644
--- a/profiles/internal/rpc/stress/stress.vdl.go
+++ b/profiles/internal/rpc/stress/stress.vdl.go
@@ -65,31 +65,17 @@
 }
 
 // StressClient returns a client stub for Stress.
-func StressClient(name string, opts ...rpc.BindOpt) StressClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implStressClientStub{name, client}
+func StressClient(name string) StressClientStub {
+	return implStressClientStub{name}
 }
 
 type implStressClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implStressClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implStressClientStub) Sum(ctx *context.T, i0 Arg, opts ...rpc.CallOpt) (o0 []byte, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Sum", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Sum", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -98,7 +84,7 @@
 
 func (c implStressClientStub) SumStream(ctx *context.T, opts ...rpc.CallOpt) (ocall StressSumStreamClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "SumStream", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "SumStream", nil, opts...); err != nil {
 		return
 	}
 	ocall = &implStressSumStreamClientCall{ClientCall: call}
@@ -107,7 +93,7 @@
 
 func (c implStressClientStub) GetStats(ctx *context.T, opts ...rpc.CallOpt) (o0 Stats, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "GetStats", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "GetStats", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -116,7 +102,7 @@
 
 func (c implStressClientStub) Stop(ctx *context.T, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Stop", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Stop", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
diff --git a/profiles/internal/rpc/test/client_test.go b/profiles/internal/rpc/test/client_test.go
index c9f59df..681e072 100644
--- a/profiles/internal/rpc/test/client_test.go
+++ b/profiles/internal/rpc/test/client_test.go
@@ -698,7 +698,7 @@
 		t.Fatalf("unexpected error: %s", err)
 	}
 	defer sh.Cleanup(os.Stderr, os.Stderr)
-	server, err := sh.Start("echoServer", nil, "--veyron.tcp.address=127.0.0.1:0", "mymessage", "")
+	server, err := sh.Start("echoServer", nil, "--v23.tcp.address=127.0.0.1:0", "mymessage", "")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -736,7 +736,7 @@
 	// Resurrect the server with the same address, verify client
 	// re-establishes the connection. This is racy if another
 	// process grabs the port.
-	server, err = sh.Start("echoServer", nil, "--veyron.tcp.address="+ep.Address, "mymessage again", "")
+	server, err = sh.Start("echoServer", nil, "--v23.tcp.address="+ep.Address, "mymessage again", "")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/profiles/internal/rpc/test/proxy_test.go b/profiles/internal/rpc/test/proxy_test.go
index 78279d6..7249a3f 100644
--- a/profiles/internal/rpc/test/proxy_test.go
+++ b/profiles/internal/rpc/test/proxy_test.go
@@ -162,7 +162,7 @@
 	proxyListenSpec := rpc.ListenSpec{Addrs: rpc.ListenAddrs{{"tcp", "127.0.0.1:0"}}}
 	proxyListenSpec.Proxy = "proxy"
 	// The proxy uses websockets only, but the server is using tcp.
-	testProxy(t, proxyListenSpec, "--veyron.tcp.protocol=ws")
+	testProxy(t, proxyListenSpec, "--v23.tcp.protocol=ws")
 }
 
 func testProxy(t *testing.T, spec rpc.ListenSpec, args ...string) {
diff --git a/profiles/internal/rt/mgmt_test.go b/profiles/internal/rt/mgmt_test.go
index 12f4bb7..55f8321 100644
--- a/profiles/internal/rt/mgmt_test.go
+++ b/profiles/internal/rt/mgmt_test.go
@@ -18,7 +18,7 @@
 	"v.io/v23/mgmt"
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/appcycle"
+	"v.io/v23/services/appcycle"
 
 	_ "v.io/x/ref/profiles"
 	vflag "v.io/x/ref/security/flag"
diff --git a/profiles/internal/rt/rt_test.go b/profiles/internal/rt/rt_test.go
index e4f7c20..405a94e 100644
--- a/profiles/internal/rt/rt_test.go
+++ b/profiles/internal/rt/rt_test.go
@@ -276,10 +276,10 @@
 	defer os.RemoveAll(cdir2)
 	createCredentialsInDir(t, cdir2, "test_cmd")
 
-	if got, want := collect(sh, credEnv, "--veyron.credentials="+cdir2), "test_cmd"; got != want {
+	if got, want := collect(sh, credEnv, "--v23.credentials="+cdir2), "test_cmd"; got != want {
 		t.Errorf("Without agent: got %q, want %q", got, want)
 	}
-	if got, want := collect(agentSh, credEnv, "--veyron.credentials="+cdir2), "test_cmd"; got != want {
+	if got, want := collect(agentSh, credEnv, "--v23.credentials="+cdir2), "test_cmd"; got != want {
 		t.Errorf("With agent: got %q, want %q", got, want)
 	}
 }
diff --git a/profiles/internal/testing/mocks/naming/namespace.go b/profiles/internal/testing/mocks/naming/namespace.go
index 39dde7a..3b4bfc9 100644
--- a/profiles/internal/testing/mocks/naming/namespace.go
+++ b/profiles/internal/testing/mocks/naming/namespace.go
@@ -39,7 +39,7 @@
 	ns     ns.Namespace
 }
 
-func (ns *namespace) Mount(ctx *context.T, name, server string, _ time.Duration, opts ...naming.MountOpt) error {
+func (ns *namespace) Mount(ctx *context.T, name, server string, _ time.Duration, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 	ns.Lock()
 	defer ns.Unlock()
@@ -57,7 +57,7 @@
 	return nil
 }
 
-func (ns *namespace) Unmount(ctx *context.T, name, server string) error {
+func (ns *namespace) Unmount(ctx *context.T, name, server string, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 	ns.Lock()
 	defer ns.Unlock()
@@ -83,7 +83,7 @@
 	return nil
 }
 
-func (ns *namespace) Delete(ctx *context.T, name string, removeSubtree bool) error {
+func (ns *namespace) Delete(ctx *context.T, name string, removeSubtree bool, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 	ns.Lock()
 	defer ns.Unlock()
@@ -103,7 +103,7 @@
 	return nil
 }
 
-func (ns *namespace) Resolve(ctx *context.T, name string, opts ...naming.ResolveOpt) (*naming.MountEntry, error) {
+func (ns *namespace) Resolve(ctx *context.T, name string, opts ...naming.NamespaceOpt) (*naming.MountEntry, error) {
 	defer vlog.LogCall()()
 	_, name = security.SplitPatternName(name)
 	if address, suffix := naming.SplitAddressName(name); len(address) > 0 {
@@ -124,7 +124,7 @@
 	return nil, verror.New(naming.ErrNoSuchName, ctx, fmt.Sprintf("Resolve name %q not found in %v", name, ns.mounts))
 }
 
-func (ns *namespace) ResolveToMountTable(ctx *context.T, name string, opts ...naming.ResolveOpt) (*naming.MountEntry, error) {
+func (ns *namespace) ResolveToMountTable(ctx *context.T, name string, opts ...naming.NamespaceOpt) (*naming.MountEntry, error) {
 	defer vlog.LogCall()()
 	// TODO(mattr): Implement this method for tests that might need it.
 	panic("ResolveToMountTable not implemented")
@@ -141,7 +141,7 @@
 	return nil
 }
 
-func (ns *namespace) Glob(ctx *context.T, pattern string) (chan interface{}, error) {
+func (ns *namespace) Glob(ctx *context.T, pattern string, opts ...naming.NamespaceOpt) (chan interface{}, error) {
 	defer vlog.LogCall()()
 	// TODO(mattr): Implement this method for tests that might need it.
 	panic("Glob not implemented")
@@ -160,13 +160,13 @@
 	return nil
 }
 
-func (ns *namespace) GetPermissions(ctx *context.T, name string) (acl access.Permissions, etag string, err error) {
+func (ns *namespace) GetPermissions(ctx *context.T, name string, opts ...naming.NamespaceOpt) (acl access.Permissions, etag string, err error) {
 	defer vlog.LogCall()()
 	panic("Calling GetPermissions on a mock namespace.  This is not supported.")
 	return nil, "", nil
 }
 
-func (ns *namespace) SetPermissions(ctx *context.T, name string, acl access.Permissions, etag string) error {
+func (ns *namespace) SetPermissions(ctx *context.T, name string, acl access.Permissions, etag string, opts ...naming.NamespaceOpt) error {
 	defer vlog.LogCall()()
 	panic("Calling SetPermissions on a mock namespace.  This is not supported.")
 	return nil
diff --git a/security/agent/agentd/main.go b/security/agent/agentd/main.go
index 5ac11be..6dc74ae 100644
--- a/security/agent/agentd/main.go
+++ b/security/agent/agentd/main.go
@@ -76,13 +76,13 @@
 	}
 
 	// This is a bit tricky. We're trying to share the runtime's
-	// veyron.credentials flag.  However we need to parse it before
+	// v23.credentials flag.  However we need to parse it before
 	// creating the runtime.  We depend on the profile's init() function
 	// calling flags.CreateAndRegister(flag.CommandLine, flags.Runtime)
 	// This will read the envvar.Credentials env var, then our call to
 	// flag.Parse() will take any override passed on the command line.
 	var dir string
-	if f := flag.Lookup("veyron.credentials").Value; true {
+	if f := flag.Lookup("v23.credentials").Value; true {
 		dir = f.String()
 		// Clear out the flag value to prevent v23.Init from
 		// trying to load this password protected principal.
diff --git a/security/agent/pingpong/wire.vdl.go b/security/agent/pingpong/wire.vdl.go
index 12a8ed4..351d0eb 100644
--- a/security/agent/pingpong/wire.vdl.go
+++ b/security/agent/pingpong/wire.vdl.go
@@ -29,31 +29,17 @@
 }
 
 // PingPongClient returns a client stub for PingPong.
-func PingPongClient(name string, opts ...rpc.BindOpt) PingPongClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implPingPongClientStub{name, client}
+func PingPongClient(name string) PingPongClientStub {
+	return implPingPongClientStub{name}
 }
 
 type implPingPongClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implPingPongClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implPingPongClientStub) Ping(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Ping", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Ping", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/security/agent/server/wire.vdl.go b/security/agent/server/wire.vdl.go
index 171d37c..5dd8a15 100644
--- a/security/agent/server/wire.vdl.go
+++ b/security/agent/server/wire.vdl.go
@@ -52,31 +52,17 @@
 }
 
 // AgentClient returns a client stub for Agent.
-func AgentClient(name string, opts ...rpc.BindOpt) AgentClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implAgentClientStub{name, client}
+func AgentClient(name string) AgentClientStub {
+	return implAgentClientStub{name}
 }
 
 type implAgentClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implAgentClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implAgentClientStub) Bless(ctx *context.T, i0 []byte, i1 security.Blessings, i2 string, i3 security.Caveat, i4 []security.Caveat, opts ...rpc.CallOpt) (o0 security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Bless", []interface{}{i0, i1, i2, i3, i4}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Bless", []interface{}{i0, i1, i2, i3, i4}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -85,7 +71,7 @@
 
 func (c implAgentClientStub) BlessSelf(ctx *context.T, i0 string, i1 []security.Caveat, opts ...rpc.CallOpt) (o0 security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessSelf", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessSelf", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -94,7 +80,7 @@
 
 func (c implAgentClientStub) Sign(ctx *context.T, i0 []byte, opts ...rpc.CallOpt) (o0 security.Signature, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Sign", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Sign", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -103,7 +89,7 @@
 
 func (c implAgentClientStub) MintDischarge(ctx *context.T, i0 security.Caveat, i1 security.Caveat, i2 []security.Caveat, opts ...rpc.CallOpt) (o0 security.Discharge, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "MintDischarge", []interface{}{i0, i1, i2}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "MintDischarge", []interface{}{i0, i1, i2}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -112,7 +98,7 @@
 
 func (c implAgentClientStub) PublicKey(ctx *context.T, opts ...rpc.CallOpt) (o0 []byte, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "PublicKey", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "PublicKey", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -121,7 +107,7 @@
 
 func (c implAgentClientStub) BlessingsByName(ctx *context.T, i0 security.BlessingPattern, opts ...rpc.CallOpt) (o0 []security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingsByName", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingsByName", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -130,7 +116,7 @@
 
 func (c implAgentClientStub) BlessingsInfo(ctx *context.T, i0 security.Blessings, opts ...rpc.CallOpt) (o0 map[string][]security.Caveat, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingsInfo", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingsInfo", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -139,7 +125,7 @@
 
 func (c implAgentClientStub) AddToRoots(ctx *context.T, i0 security.Blessings, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "AddToRoots", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "AddToRoots", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -148,7 +134,7 @@
 
 func (c implAgentClientStub) BlessingStoreSet(ctx *context.T, i0 security.Blessings, i1 security.BlessingPattern, opts ...rpc.CallOpt) (o0 security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingStoreSet", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingStoreSet", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -157,7 +143,7 @@
 
 func (c implAgentClientStub) BlessingStoreForPeer(ctx *context.T, i0 []string, opts ...rpc.CallOpt) (o0 security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingStoreForPeer", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingStoreForPeer", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -166,7 +152,7 @@
 
 func (c implAgentClientStub) BlessingStoreSetDefault(ctx *context.T, i0 security.Blessings, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingStoreSetDefault", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingStoreSetDefault", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -175,7 +161,7 @@
 
 func (c implAgentClientStub) BlessingStoreDefault(ctx *context.T, opts ...rpc.CallOpt) (o0 security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingStoreDefault", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingStoreDefault", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -184,7 +170,7 @@
 
 func (c implAgentClientStub) BlessingStorePeerBlessings(ctx *context.T, opts ...rpc.CallOpt) (o0 map[security.BlessingPattern]security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingStorePeerBlessings", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingStorePeerBlessings", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -193,7 +179,7 @@
 
 func (c implAgentClientStub) BlessingStoreDebugString(ctx *context.T, opts ...rpc.CallOpt) (o0 string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingStoreDebugString", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingStoreDebugString", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -202,7 +188,7 @@
 
 func (c implAgentClientStub) BlessingRootsAdd(ctx *context.T, i0 []byte, i1 security.BlessingPattern, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingRootsAdd", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingRootsAdd", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -211,7 +197,7 @@
 
 func (c implAgentClientStub) BlessingRootsRecognized(ctx *context.T, i0 []byte, i1 string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingRootsRecognized", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingRootsRecognized", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -220,7 +206,7 @@
 
 func (c implAgentClientStub) BlessingRootsDebugString(ctx *context.T, opts ...rpc.CallOpt) (o0 string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessingRootsDebugString", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessingRootsDebugString", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -229,7 +215,7 @@
 
 func (c implAgentClientStub) NotifyWhenChanged(ctx *context.T, opts ...rpc.CallOpt) (ocall AgentNotifyWhenChangedClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "NotifyWhenChanged", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "NotifyWhenChanged", nil, opts...); err != nil {
 		return
 	}
 	ocall = &implAgentNotifyWhenChangedClientCall{ClientCall: call}
diff --git a/security/flag/flag.go b/security/flag/flag.go
index 7be9dd0..f8fbb97 100644
--- a/security/flag/flag.go
+++ b/security/flag/flag.go
@@ -21,7 +21,7 @@
 const pkgPath = "v.io/x/ref/security/flag"
 
 var (
-	errCantOpenACLFile = verror.Register(pkgPath+".errCantOpenACLFile", verror.NoRetry, "{1:}{2:} cannot open argument to --veyron.acl.file {3}{:_}")
+	errCantOpenPermissionsFile = verror.Register(pkgPath+".errCantOpenPermissionsFile", verror.NoRetry, "{1:}{2:} cannot open argument to --v23.permissions.file {3}{:_}")
 )
 
 var authFlags *flags.Flags
@@ -30,8 +30,8 @@
 	authFlags = flags.CreateAndRegister(flag.CommandLine, flags.AccessList)
 }
 
-// NewAuthorizerOrDie constructs an Authorizer based on the provided "--veyron.acl.literal" or
-// "--veyron.acl.file" flags. Otherwise it creates a default Authorizer.
+// NewAuthorizerOrDie constructs an Authorizer based on the provided "--v23.permissions.literal" or
+// "--v23.permissions.file" flags. Otherwise it creates a default Authorizer.
 func NewAuthorizerOrDie() security.Authorizer {
 	flags := authFlags.AccessListFlags()
 	fname := flags.AccessListFile("runtime")
@@ -73,7 +73,7 @@
 	if literal == "" {
 		file, err := os.Open(fname)
 		if err != nil {
-			return nil, verror.New(errCantOpenACLFile, nil, fname)
+			return nil, verror.New(errCantOpenPermissionsFile, nil, fname)
 		}
 		defer file.Close()
 		return access.ReadPermissions(file)
diff --git a/security/flag/flag_test.go b/security/flag/flag_test.go
index 7a53492..97c13c3 100644
--- a/security/flag/flag_test.go
+++ b/security/flag/flag_test.go
@@ -95,17 +95,17 @@
 	}{
 		{
 			cmd:   "tamFromFlag",
-			flags: []string{"--veyron.acl.file", "runtime:" + filename},
+			flags: []string{"--v23.permissions.file", "runtime:" + filename},
 			auth:  "perms2",
 		},
 		{
 			cmd:   "tamFromFlag",
-			flags: []string{"--veyron.acl.literal", "{}"},
+			flags: []string{"--v23.permissions.literal", "{}"},
 			auth:  "empty",
 		},
 		{
 			cmd:   "tamFromFlag",
-			flags: []string{"--veyron.acl.literal", `{"Read": {"In":["v23/alice/$", "v23/bob"]}, "Write": {"In":["v23/alice/$"]}}`},
+			flags: []string{"--v23.permissions.literal", `{"Read": {"In":["v23/alice/$", "v23/bob"]}, "Write": {"In":["v23/alice/$"]}}`},
 			auth:  "perms2",
 		},
 	}
diff --git a/services/identity/identity.vdl.go b/services/identity/identity.vdl.go
index 861dad8..08a329c 100644
--- a/services/identity/identity.vdl.go
+++ b/services/identity/identity.vdl.go
@@ -66,31 +66,17 @@
 }
 
 // OAuthBlesserClient returns a client stub for OAuthBlesser.
-func OAuthBlesserClient(name string, opts ...rpc.BindOpt) OAuthBlesserClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implOAuthBlesserClientStub{name, client}
+func OAuthBlesserClient(name string) OAuthBlesserClientStub {
+	return implOAuthBlesserClientStub{name}
 }
 
 type implOAuthBlesserClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implOAuthBlesserClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implOAuthBlesserClientStub) BlessUsingAccessToken(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 security.Blessings, o1 string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessUsingAccessToken", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessUsingAccessToken", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0, &o1)
@@ -206,31 +192,17 @@
 }
 
 // MacaroonBlesserClient returns a client stub for MacaroonBlesser.
-func MacaroonBlesserClient(name string, opts ...rpc.BindOpt) MacaroonBlesserClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implMacaroonBlesserClientStub{name, client}
+func MacaroonBlesserClient(name string) MacaroonBlesserClientStub {
+	return implMacaroonBlesserClientStub{name}
 }
 
 type implMacaroonBlesserClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implMacaroonBlesserClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implMacaroonBlesserClientStub) Bless(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Bless", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Bless", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/services/identity/identityd/identityd_v23_test.go b/services/identity/identityd/identityd_v23_test.go
index 5326c2f..923d72a 100644
--- a/services/identity/identityd/identityd_v23_test.go
+++ b/services/identity/identityd/identityd_v23_test.go
@@ -62,7 +62,7 @@
 }
 
 func V23TestIdentityServer(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 	// Start identityd:
 	//
 	// identityd must have credentials that recognize the root mounttable.
@@ -76,7 +76,7 @@
 	}
 	identityd = identityd.WithStartOpts(identityd.StartOpts().WithCustomCredentials(creds))
 	httpaddr := identityd.Start(
-		"-veyron.tcp.address=127.0.0.1:0",
+		"-v23.tcp.address=127.0.0.1:0",
 		"-httpaddr=127.0.0.1:0").ExpectVar("HTTP_ADDR")
 
 	// Use the principal tool to seekblessings.
diff --git a/services/mgmt/application/applicationd/acl_test.go b/services/mgmt/application/applicationd/acl_test.go
index 99c3b03..950fd58 100644
--- a/services/mgmt/application/applicationd/acl_test.go
+++ b/services/mgmt/application/applicationd/acl_test.go
@@ -16,7 +16,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
diff --git a/services/mgmt/application/applicationd/applicationd_v23_test.go b/services/mgmt/application/applicationd/applicationd_v23_test.go
index e2a5981..dce2244 100644
--- a/services/mgmt/application/applicationd/applicationd_v23_test.go
+++ b/services/mgmt/application/applicationd/applicationd_v23_test.go
@@ -10,7 +10,7 @@
 	"strings"
 
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/x/ref/test/v23tests"
 )
 
@@ -53,7 +53,7 @@
 }
 
 func V23TestApplicationRepository(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	// Start the application repository.
 	appRepoName := "test-app-repo"
@@ -61,7 +61,7 @@
 		"-name="+appRepoName,
 		"-store="+i.NewTempDir(),
 		"-v=2",
-		"-veyron.tcp.address=127.0.0.1:0")
+		"-v23.tcp.address=127.0.0.1:0")
 
 	// Build the client binary (must be a delegate of the server to pass
 	// the default authorization policy).
diff --git a/services/mgmt/application/applicationd/impl_test.go b/services/mgmt/application/applicationd/impl_test.go
index 2b58ba8..f4c5ea1 100644
--- a/services/mgmt/application/applicationd/impl_test.go
+++ b/services/mgmt/application/applicationd/impl_test.go
@@ -14,7 +14,7 @@
 	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/v23/verror"
 
 	appd "v.io/x/ref/services/mgmt/application/applicationd"
diff --git a/services/mgmt/application/applicationd/service.go b/services/mgmt/application/applicationd/service.go
index 7ec48b8..2568f64 100644
--- a/services/mgmt/application/applicationd/service.go
+++ b/services/mgmt/application/applicationd/service.go
@@ -14,7 +14,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 )
diff --git a/services/mgmt/binary/binaryd/binaryd_v23_test.go b/services/mgmt/binary/binaryd/binaryd_v23_test.go
index 83b2c94..0e93686 100644
--- a/services/mgmt/binary/binaryd/binaryd_v23_test.go
+++ b/services/mgmt/binary/binaryd/binaryd_v23_test.go
@@ -96,7 +96,7 @@
 }
 
 func V23TestBinaryRepositoryIntegration(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	// Build the required binaries.
 	// The client must run as a "delegate" of the server in order to pass
@@ -111,7 +111,7 @@
 	binaryRepoBin.Start(
 		"-name="+binaryRepoName,
 		"-http=127.0.0.1:0",
-		"-veyron.tcp.address=127.0.0.1:0")
+		"-v23.tcp.address=127.0.0.1:0")
 
 	// Upload a random binary file.
 	binFile := i.NewTempFile()
diff --git a/services/mgmt/binary/impl/acl_test.go b/services/mgmt/binary/impl/acl_test.go
index dc90be2..da76e54 100644
--- a/services/mgmt/binary/impl/acl_test.go
+++ b/services/mgmt/binary/impl/acl_test.go
@@ -17,7 +17,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
diff --git a/services/mgmt/binary/impl/dispatcher.go b/services/mgmt/binary/impl/dispatcher.go
index 83a39da..ff967c4 100644
--- a/services/mgmt/binary/impl/dispatcher.go
+++ b/services/mgmt/binary/impl/dispatcher.go
@@ -9,7 +9,7 @@
 
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 
 	"v.io/x/ref/services/mgmt/lib/acls"
 )
diff --git a/services/mgmt/binary/impl/http_test.go b/services/mgmt/binary/impl/http_test.go
index 3472ab3..d4c10d8 100644
--- a/services/mgmt/binary/impl/http_test.go
+++ b/services/mgmt/binary/impl/http_test.go
@@ -14,7 +14,7 @@
 
 	"v.io/v23"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 
 	"v.io/x/ref/services/mgmt/binary/impl"
 	"v.io/x/ref/test"
diff --git a/services/mgmt/binary/impl/impl_test.go b/services/mgmt/binary/impl/impl_test.go
index 4f308e4..435465f 100644
--- a/services/mgmt/binary/impl/impl_test.go
+++ b/services/mgmt/binary/impl/impl_test.go
@@ -17,7 +17,7 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
diff --git a/services/mgmt/binary/impl/service.go b/services/mgmt/binary/impl/service.go
index 46e4b0f..dd279d8 100644
--- a/services/mgmt/binary/impl/service.go
+++ b/services/mgmt/binary/impl/service.go
@@ -43,8 +43,8 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/mgmt/lib/acls"
diff --git a/services/mgmt/binary/impl/util_test.go b/services/mgmt/binary/impl/util_test.go
index dd208ac..8f8534f 100644
--- a/services/mgmt/binary/impl/util_test.go
+++ b/services/mgmt/binary/impl/util_test.go
@@ -11,7 +11,7 @@
 	"testing"
 
 	"v.io/v23/context"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 
 	"v.io/x/ref/services/mgmt/binary/impl"
 	"v.io/x/ref/test/testutil"
diff --git a/services/mgmt/build/buildd/buildd_v23_test.go b/services/mgmt/build/buildd/buildd_v23_test.go
index e365306..1eaba06 100644
--- a/services/mgmt/build/buildd/buildd_v23_test.go
+++ b/services/mgmt/build/buildd/buildd_v23_test.go
@@ -32,7 +32,7 @@
 	}
 	goRoot := runtime.GOROOT()
 
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	// Build binaries for the client and server.
 	// Since ACLs are not setup on the server, the client must pass the
@@ -49,7 +49,7 @@
 		"-name="+buildServerName,
 		"-gobin="+goBin,
 		"-goroot="+goRoot,
-		"-veyron.tcp.address=127.0.0.1:0")
+		"-v23.tcp.address=127.0.0.1:0")
 
 	// Create and build a test source file.
 	testGoPath := i.NewTempDir()
diff --git a/services/mgmt/build/buildd/main.go b/services/mgmt/build/buildd/main.go
index fbab4d0..3d601d7 100644
--- a/services/mgmt/build/buildd/main.go
+++ b/services/mgmt/build/buildd/main.go
@@ -9,7 +9,7 @@
 	"os"
 
 	"v.io/v23"
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/build"
 	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/lib/signals"
diff --git a/services/mgmt/build/impl/impl_test.go b/services/mgmt/build/impl/impl_test.go
index 140cc39..7eba418 100644
--- a/services/mgmt/build/impl/impl_test.go
+++ b/services/mgmt/build/impl/impl_test.go
@@ -14,7 +14,7 @@
 
 	"v.io/v23"
 	"v.io/v23/context"
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/build"
 
 	_ "v.io/x/ref/profiles"
 	"v.io/x/ref/test"
diff --git a/services/mgmt/build/impl/service.go b/services/mgmt/build/impl/service.go
index 1466d55..54adcc9 100644
--- a/services/mgmt/build/impl/service.go
+++ b/services/mgmt/build/impl/service.go
@@ -14,8 +14,8 @@
 	"runtime"
 
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/build"
 	"v.io/v23/verror"
 	"v.io/x/lib/host"
 	"v.io/x/lib/vlog"
diff --git a/services/mgmt/build/impl/util.go b/services/mgmt/build/impl/util.go
index cff6ed0..8619690 100644
--- a/services/mgmt/build/impl/util.go
+++ b/services/mgmt/build/impl/util.go
@@ -7,7 +7,7 @@
 import (
 	"runtime"
 
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/build"
 )
 
 func getArch() build.Architecture {
diff --git a/services/mgmt/debug/dispatcher_test.go b/services/mgmt/debug/dispatcher_test.go
index af0f472..30d065a 100644
--- a/services/mgmt/debug/dispatcher_test.go
+++ b/services/mgmt/debug/dispatcher_test.go
@@ -20,9 +20,9 @@
 	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/logreader"
-	"v.io/v23/services/mgmt/stats"
-	vtracesvc "v.io/v23/services/mgmt/vtrace"
+	"v.io/v23/services/logreader"
+	"v.io/v23/services/stats"
+	s_vtrace "v.io/v23/services/vtrace"
 	"v.io/v23/vdl"
 	"v.io/v23/verror"
 	"v.io/v23/vtrace"
@@ -151,7 +151,7 @@
 
 	// Access vtrace.
 	{
-		vt := vtracesvc.StoreClient(naming.JoinAddressName(endpoint, "debug/vtrace"))
+		vt := s_vtrace.StoreClient(naming.JoinAddressName(endpoint, "debug/vtrace"))
 		call, err := vt.AllTraces(ctx)
 		if err != nil {
 			t.Errorf("AllTraces failed: %v", err)
diff --git a/services/mgmt/device/config.vdl.go b/services/mgmt/device/config.vdl.go
index e2b60bd..769efa9 100644
--- a/services/mgmt/device/config.vdl.go
+++ b/services/mgmt/device/config.vdl.go
@@ -30,31 +30,17 @@
 }
 
 // ConfigClient returns a client stub for Config.
-func ConfigClient(name string, opts ...rpc.BindOpt) ConfigClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implConfigClientStub{name, client}
+func ConfigClient(name string) ConfigClientStub {
+	return implConfigClientStub{name}
 }
 
 type implConfigClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implConfigClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implConfigClientStub) Set(ctx *context.T, i0 string, i1 string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Set", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Set", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
diff --git a/services/mgmt/device/config/config.go b/services/mgmt/device/config/config.go
index f60ca22..16b96b0 100644
--- a/services/mgmt/device/config/config.go
+++ b/services/mgmt/device/config/config.go
@@ -30,7 +30,7 @@
 
 	"v.io/x/ref/envvar"
 
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/v23/verror"
 )
 
diff --git a/services/mgmt/device/config/config_test.go b/services/mgmt/device/config/config_test.go
index 149fe0c..4356961 100644
--- a/services/mgmt/device/config/config_test.go
+++ b/services/mgmt/device/config/config_test.go
@@ -13,7 +13,7 @@
 
 	"v.io/x/ref/services/mgmt/device/config"
 
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 )
 
 // TestState checks that encoding/decoding State to child/from parent works
diff --git a/services/mgmt/device/config/const.go b/services/mgmt/device/config/const.go
index c722c8d..e6d33ba 100644
--- a/services/mgmt/device/config/const.go
+++ b/services/mgmt/device/config/const.go
@@ -7,22 +7,22 @@
 const (
 	// EnvelopeEnv is the name of the environment variable that holds the
 	// serialized device manager application envelope.
-	EnvelopeEnv = "VEYRON_DM_ENVELOPE"
+	EnvelopeEnv = "V23_DM_ENVELOPE"
 	// PreviousEnv is the name of the environment variable that holds the
 	// path to the previous version of the device manager.
-	PreviousEnv = "VEYRON_DM_PREVIOUS"
+	PreviousEnv = "V23_DM_PREVIOUS"
 	// OriginEnv is the name of the environment variable that holds the
 	// object name of the application repository that can be used to
 	// retrieve the device manager application envelope.
-	OriginEnv = "VEYRON_DM_ORIGIN"
+	OriginEnv = "V23_DM_ORIGIN"
 	// RootEnv is the name of the environment variable that holds the
 	// path to the directory in which device manager workspaces are
 	// created.
-	RootEnv = "VEYRON_DM_ROOT"
+	RootEnv = "V23_DM_ROOT"
 	// CurrentLinkEnv is the name of the environment variable that holds
 	// the path to the soft link that points to the current device manager.
-	CurrentLinkEnv = "VEYRON_DM_CURRENT"
+	CurrentLinkEnv = "V23_DM_CURRENT"
 	// HelperEnv is the name of the environment variable that holds the path
 	// to the suid helper used to start apps as specific system users.
-	HelperEnv = "VEYRON_DM_HELPER"
+	HelperEnv = "V23_DM_HELPER"
 )
diff --git a/services/mgmt/device/deviced/commands.go b/services/mgmt/device/deviced/commands.go
index 822b3a2..87af138 100644
--- a/services/mgmt/device/deviced/commands.go
+++ b/services/mgmt/device/deviced/commands.go
@@ -27,7 +27,7 @@
 	initMode    bool
 )
 
-const deviceDirEnv = "VANADIUM_DEVICE_DIR"
+const deviceDirEnv = "V23_DEVICE_DIR"
 
 func installationDir() string {
 	if d := os.Getenv(deviceDirEnv); d != "" {
diff --git a/services/mgmt/device/deviced/server.go b/services/mgmt/device/deviced/server.go
index b6be531..544f05c 100644
--- a/services/mgmt/device/deviced/server.go
+++ b/services/mgmt/device/deviced/server.go
@@ -42,7 +42,7 @@
 	publishAs       = flag.String("name", "", "name to publish the device manager at")
 	restartExitCode = flag.Int("restart_exit_code", 0, "exit code to return when device manager should be restarted")
 	nhName          = flag.String("neighborhood_name", "", `if provided, it will enable sharing with the local neighborhood with the provided name. The address of the local mounttable will be published to the neighboorhood and everything in the neighborhood will be visible on the local mounttable.`)
-	dmPort          = flag.Int("deviced_port", 0, "the port number of assign to the device manager service. The hostname/IP address part of --veyron.tcp.address is used along with this port. By default, the port is assigned by the OS.")
+	dmPort          = flag.Int("deviced_port", 0, "the port number of assign to the device manager service. The hostname/IP address part of --v23.tcp.address is used along with this port. By default, the port is assigned by the OS.")
 	proxyPort       = flag.Int("proxy_port", 0, "the port number to assign to the proxy service. 0 means no proxy service.")
 	usePairingToken = flag.Bool("use_pairing_token", false, "generate a pairing token for the device manager that will need to be provided when a device is claimed")
 )
diff --git a/services/mgmt/device/doc.go b/services/mgmt/device/doc.go
index 99285d5..92919c7 100644
--- a/services/mgmt/device/doc.go
+++ b/services/mgmt/device/doc.go
@@ -21,10 +21,9 @@
 // link to enable auto-updates.  To enable updates, in addition to the symbolic
 // link path, the device manager needs to be told what its application metadata
 // is (such as command-line arguments and environment variables, i.e. the
-// application envelope defined in the veyron2/services/mgmt/application
-// package), as well as the object name for where it can fetch an updated
-// envelope, and the local filesystem path for its previous version (for
-// rollbacks).
+// application envelope defined in the v.io/v23/services/application package),
+// as well as the object name for where it can fetch an updated envelope, and
+// the local filesystem path for its previous version (for rollbacks).
 //
 // Finally, the device manager needs to know its own object name, so it can pass
 // that along to the applications that it starts.
diff --git a/services/mgmt/device/impl/app_service.go b/services/mgmt/device/impl/app_service.go
index 1de87ed..6d94a0f 100644
--- a/services/mgmt/device/impl/app_service.go
+++ b/services/mgmt/device/impl/app_service.go
@@ -145,9 +145,9 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/appcycle"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/appcycle"
+	"v.io/v23/services/application"
+	"v.io/v23/services/device"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
@@ -838,7 +838,7 @@
 	cfg.Set(mgmt.ParentBlessingConfigKey, info.DeviceManagerPeerPattern)
 
 	appAclDir := filepath.Join(instanceDir, "debugacls", "data")
-	cfg.Set("veyron.acl.file", "runtime:"+appAclDir)
+	cfg.Set("v23.permissions.file", "runtime:"+appAclDir)
 
 	// Set up any agent-specific state.
 	// NOTE(caprita): This ought to belong in genCmd.
@@ -882,7 +882,12 @@
 		agentCleaner()
 	}
 
-	// Wait for the child process to start.
+	// Wait for the suidhelper to exit.
+	if err := handle.Wait(0); err != nil {
+		return 0, verror.New(ErrOperationFailed, ctx, fmt.Sprintf("Wait() on suidhelper failed: %v", err))
+	}
+
+	// Wait for the process invoked by suidhelper to become ready.
 	if err := handle.WaitForReady(childReadyTimeout); err != nil {
 		return 0, verror.New(ErrOperationFailed, ctx, fmt.Sprintf("WaitForReady(%v) failed: %v", childReadyTimeout, err))
 	}
diff --git a/services/mgmt/device/impl/app_state.go b/services/mgmt/device/impl/app_state.go
index 6c191c2..97a7964 100644
--- a/services/mgmt/device/impl/app_state.go
+++ b/services/mgmt/device/impl/app_state.go
@@ -10,7 +10,7 @@
 	"os"
 	"path/filepath"
 
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/v23/verror"
 )
 
diff --git a/services/mgmt/device/impl/app_state_test.go b/services/mgmt/device/impl/app_state_test.go
index 6057069..f0e626d 100644
--- a/services/mgmt/device/impl/app_state_test.go
+++ b/services/mgmt/device/impl/app_state_test.go
@@ -9,7 +9,7 @@
 	"os"
 	"testing"
 
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 )
 
 // TestInstallationState verifies the state transition logic for app installations.
diff --git a/services/mgmt/device/impl/association_state.go b/services/mgmt/device/impl/association_state.go
index 8a5a673..2f25912 100644
--- a/services/mgmt/device/impl/association_state.go
+++ b/services/mgmt/device/impl/association_state.go
@@ -10,7 +10,7 @@
 	"path/filepath"
 	"sync"
 
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/v23/verror"
 )
 
diff --git a/services/mgmt/device/impl/association_state_test.go b/services/mgmt/device/impl/association_state_test.go
index 0d09a89..0c5bb8a 100644
--- a/services/mgmt/device/impl/association_state_test.go
+++ b/services/mgmt/device/impl/association_state_test.go
@@ -11,7 +11,7 @@
 	"path"
 	"testing"
 
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/x/ref/services/mgmt/device/impl"
 )
 
diff --git a/services/mgmt/device/impl/device_installer.go b/services/mgmt/device/impl/device_installer.go
index 8175e10..5fbd73e 100644
--- a/services/mgmt/device/impl/device_installer.go
+++ b/services/mgmt/device/impl/device_installer.go
@@ -54,7 +54,7 @@
 
 	"v.io/v23/context"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 
 	"v.io/x/ref/envvar"
 	"v.io/x/ref/services/mgmt/device/config"
@@ -81,8 +81,7 @@
 // TODO(caprita,ashankar): Remove VEYRON_.* and NAMESPACE_ROOT.*.
 var allowedVarsRE = regexp.MustCompile("V23_.*|VEYRON_.*|NAMESPACE_ROOT.*|PAUSE_BEFORE_STOP|TMPDIR")
 
-// TODO(caprita,ashankar): Replace VEYRON_EXEC_VERSION with V23_EXEC_VERSION
-var deniedVarsRE = regexp.MustCompile("VEYRON_EXEC_VERSION")
+var deniedVarsRE = regexp.MustCompile("V23_EXEC_VERSION")
 
 // filterEnvironment returns only the environment variables, specified by
 // the env parameter, whose names match the supplied regexp.
diff --git a/services/mgmt/device/impl/device_service.go b/services/mgmt/device/impl/device_service.go
index 86a3ae1..6761f2e 100644
--- a/services/mgmt/device/impl/device_service.go
+++ b/services/mgmt/device/impl/device_service.go
@@ -58,9 +58,9 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/application"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/device"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/flags/buildinfo"
diff --git a/services/mgmt/device/impl/dispatcher.go b/services/mgmt/device/impl/dispatcher.go
index 044243b..4f0f4fa 100644
--- a/services/mgmt/device/impl/dispatcher.go
+++ b/services/mgmt/device/impl/dispatcher.go
@@ -25,9 +25,9 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/device"
-	"v.io/v23/services/mgmt/pprof"
-	"v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/device"
+	"v.io/v23/services/pprof"
+	"v.io/v23/services/stats"
 	"v.io/v23/vdl"
 	"v.io/v23/vdlroot/signature"
 	"v.io/v23/verror"
diff --git a/services/mgmt/device/impl/impl_test.go b/services/mgmt/device/impl/impl_test.go
index 2991672..d155a1d 100644
--- a/services/mgmt/device/impl/impl_test.go
+++ b/services/mgmt/device/impl/impl_test.go
@@ -38,9 +38,9 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/device"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/application"
+	"v.io/v23/services/device"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 
 	"v.io/x/ref/envvar"
diff --git a/services/mgmt/device/impl/instance_reaping.go b/services/mgmt/device/impl/instance_reaping.go
index 0ca7e88..2c7da8c 100644
--- a/services/mgmt/device/impl/instance_reaping.go
+++ b/services/mgmt/device/impl/instance_reaping.go
@@ -12,8 +12,8 @@
 
 	"v.io/v23/context"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/device"
-	"v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/device"
+	"v.io/v23/services/stats"
 	"v.io/v23/vdl"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
diff --git a/services/mgmt/device/impl/instance_reaping_test.go b/services/mgmt/device/impl/instance_reaping_test.go
index cdb7158..8b0e906 100644
--- a/services/mgmt/device/impl/instance_reaping_test.go
+++ b/services/mgmt/device/impl/instance_reaping_test.go
@@ -14,8 +14,8 @@
 
 	"v.io/v23/context"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/device"
-	"v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/device"
+	"v.io/v23/services/stats"
 	"v.io/v23/vdl"
 
 	"v.io/x/ref/envvar"
diff --git a/services/mgmt/device/impl/mock_repo_test.go b/services/mgmt/device/impl/mock_repo_test.go
index 04d9817..527c01c 100644
--- a/services/mgmt/device/impl/mock_repo_test.go
+++ b/services/mgmt/device/impl/mock_repo_test.go
@@ -17,9 +17,9 @@
 	"v.io/v23/context"
 	"v.io/v23/rpc"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/application"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
diff --git a/services/mgmt/device/impl/only_for_test.go b/services/mgmt/device/impl/only_for_test.go
index aaea14e..23bcc37 100644
--- a/services/mgmt/device/impl/only_for_test.go
+++ b/services/mgmt/device/impl/only_for_test.go
@@ -11,7 +11,7 @@
 	"path/filepath"
 
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/device"
 	"v.io/x/lib/vlog"
 )
 
diff --git a/services/mgmt/device/impl/profile.go b/services/mgmt/device/impl/profile.go
index 7e810ac..b430bdb 100644
--- a/services/mgmt/device/impl/profile.go
+++ b/services/mgmt/device/impl/profile.go
@@ -13,8 +13,8 @@
 
 	"v.io/x/ref/services/mgmt/profile"
 
-	"v.io/v23/services/mgmt/build"
-	"v.io/v23/services/mgmt/device"
+	"v.io/v23/services/build"
+	"v.io/v23/services/device"
 )
 
 // ComputeDeviceProfile generates a description of the runtime
diff --git a/services/mgmt/device/impl/proxy_invoker_test.go b/services/mgmt/device/impl/proxy_invoker_test.go
index ef6063b..5f8f002 100644
--- a/services/mgmt/device/impl/proxy_invoker_test.go
+++ b/services/mgmt/device/impl/proxy_invoker_test.go
@@ -13,7 +13,7 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/stats"
 
 	"v.io/x/lib/vlog"
 
diff --git a/services/mgmt/device/impl/util.go b/services/mgmt/device/impl/util.go
index c449ae2..25836e8 100644
--- a/services/mgmt/device/impl/util.go
+++ b/services/mgmt/device/impl/util.go
@@ -19,8 +19,8 @@
 
 	"v.io/v23/context"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/application"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 )
diff --git a/services/mgmt/device/impl/util_test.go b/services/mgmt/device/impl/util_test.go
index 7e0614c..8158ddc 100644
--- a/services/mgmt/device/impl/util_test.go
+++ b/services/mgmt/device/impl/util_test.go
@@ -25,11 +25,11 @@
 	"v.io/v23/options"
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/device"
-	"v.io/v23/services/mgmt/logreader"
-	"v.io/v23/services/mgmt/pprof"
-	"v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/application"
+	"v.io/v23/services/device"
+	"v.io/v23/services/logreader"
+	"v.io/v23/services/pprof"
+	"v.io/v23/services/stats"
 	"v.io/v23/verror"
 
 	_ "v.io/x/ref/profiles/roaming"
diff --git a/services/mgmt/device/starter/starter.go b/services/mgmt/device/starter/starter.go
index 3bfbf2a..31f167a 100644
--- a/services/mgmt/device/starter/starter.go
+++ b/services/mgmt/device/starter/starter.go
@@ -218,7 +218,7 @@
 	// actual proxy app.  Once support is added to the RPC layer to allow
 	// install-local to serve on the same connection it established to the
 	// device manager (see TODO in
-	// veyron/tools/mgmt/device/impl/local_install.go), we can get rid of
+	// v.io/x/ref/cmd/mgmt/device/impl/local_install.go), we can get rid of
 	// this local proxy altogether.
 	stopProxy, err := startProxyServer(ctx, args.Proxy, mtName)
 	if err != nil {
@@ -343,7 +343,7 @@
 	for _, root := range ns.Roots() {
 		go func(r string) {
 			for {
-				err := ns.Mount(ctx, naming.Join(localMT, "global"), r, 0 /* forever */, naming.ServesMountTableOpt(true))
+				err := ns.Mount(ctx, naming.Join(localMT, "global"), r, 0 /* forever */, naming.ServesMountTable(true))
 				if err == nil {
 					break
 				}
@@ -387,7 +387,7 @@
 			origep.Addr().String(),
 			origep.RoutingID(),
 			origep.RPCVersionRange(),
-			naming.ServesMountTableOpt(origep.ServesMountTable()))
+			naming.ServesMountTable(origep.ServesMountTable()))
 		roots[i] = naming.JoinAddressName(ep, suffix)
 	}
 	vlog.Infof("Changing namespace roots from %v to %v", origroots, roots)
diff --git a/services/mgmt/lib/acls/hierarchical_authorizer.go b/services/mgmt/lib/acls/hierarchical_authorizer.go
index 142b59d..5b5e921 100644
--- a/services/mgmt/lib/acls/hierarchical_authorizer.go
+++ b/services/mgmt/lib/acls/hierarchical_authorizer.go
@@ -9,13 +9,15 @@
 	"v.io/v23/security"
 	"v.io/v23/security/access"
 	"v.io/x/lib/vlog"
+
+	"v.io/x/ref/profiles/internal/rpc"
 )
 
-// hierarchicalAuthorizer manages a pair of authorizers for two-level
-// inheritance of AccessLists.
+// hierarchicalAuthorizer contains the state needed to implement
+// hierarchical authorization in the Authorize method.
 type hierarchicalAuthorizer struct {
-	child          security.Authorizer
-	rootAccessList access.AccessList
+	rootDir, childDir string
+	get               TAMGetter
 }
 
 // TAMGetter defines an abstract interface that a customer of
@@ -38,48 +40,55 @@
 	return rootAuth, nil
 }
 
-// NewHierarchicalAuthorizer creates a new hierarchicalAuthorizer
+// NewHierarchicalAuthorizer creates a new hierarchicalAuthorizer: one
+// that implements a "root" like concept: admin rights at the root of
+// a server can invoke RPCs regardless of permissions set on child objects.
 func NewHierarchicalAuthorizer(rootDir, childDir string, get TAMGetter) (security.Authorizer, error) {
-	rootTam, intentionallyEmpty, err := get.TAMForPath(rootDir)
-	if err != nil {
-		return nil, err
-	} else if intentionallyEmpty {
-		vlog.VI(2).Infof("TAMForPath(%s) is intentionally empty", rootDir)
-		return nil, nil
-	}
-
-	// We are at the root so exit early.
-	if rootDir == childDir {
-		return mkRootAuth(rootTam)
-	}
-
-	// This is not fatal: the childDir may not exist if we are invoking
-	// a Create() method so we only use the root AccessList.
-	childTam, intentionallyEmpty, err := get.TAMForPath(childDir)
-	if err != nil {
-		return nil, err
-	} else if intentionallyEmpty {
-		return mkRootAuth(rootTam)
-	}
-
-	childAuth, err := access.PermissionsAuthorizer(childTam, access.TypicalTagType())
-	if err != nil {
-		vlog.Errorf("Successfully obtained an AccessList from the filesystem but PermissionsAuthorizer couldn't use it: %v", err)
-		return nil, err
-	}
-
 	return &hierarchicalAuthorizer{
-		child:          childAuth,
-		rootAccessList: rootTam[string(access.Admin)],
+		rootDir:  rootDir,
+		childDir: childDir,
+		get:      get,
 	}, nil
 }
 
-// Authorize provides two-levels of authorization. Admin permission
-// on the root provides a "superuser"-like power for administering the
-// server using an instance of hierarchicalAuthorizer. Otherwise, the
-// default permissions of the named path apply.
 func (ha *hierarchicalAuthorizer) Authorize(ctx *context.T) error {
-	childErr := ha.child.Authorize(ctx)
+	rootPerms, intentionallyEmpty, err := ha.get.TAMForPath(ha.rootDir)
+	if err != nil {
+		return err
+	} else if intentionallyEmpty {
+		vlog.VI(2).Infof("TAMForPath(%s) is intentionally empty", ha.rootDir)
+		return defaultAuthorizer(ctx)
+	}
+
+	// We are at the root so exit early.
+	if ha.rootDir == ha.childDir {
+		a, err := mkRootAuth(rootPerms)
+		if err != nil {
+			return err
+		}
+		return a.Authorize(ctx)
+	}
+
+	// This is not fatal: the childDir may not exist if we are invoking
+	// a Create() method so we only use the root Permissions.
+	childPerms, intentionallyEmpty, err := ha.get.TAMForPath(ha.childDir)
+	if err != nil {
+		return err
+	} else if intentionallyEmpty {
+		a, err := mkRootAuth(rootPerms)
+		if err != nil {
+			return err
+		}
+		return a.Authorize(ctx)
+	}
+
+	childAuth, err := access.PermissionsAuthorizer(childPerms, access.TypicalTagType())
+	if err != nil {
+		vlog.Errorf("Successfully obtained a Permissions from the filesystem but PermissionsAuthorizer couldn't use it: %v", err)
+		return err
+	}
+
+	childErr := childAuth.Authorize(ctx)
 	if childErr == nil {
 		return nil
 	}
@@ -87,9 +96,35 @@
 	// Maybe the invoking principal can invoke this method because
 	// it has root permissions.
 	names, _ := security.RemoteBlessingNames(ctx)
-	if len(names) > 0 && ha.rootAccessList.Includes(names...) {
+	if len(names) > 0 && rootPerms[string(access.Admin)].Includes(names...) {
 		return nil
 	}
 
 	return childErr
 }
+
+// defaultAuthorizer implements an authorization policy that requires one end
+// of the RPC to have a blessing that makes it a delegate of the other.
+// TODO(rjkroege): Remove this when the defaultAuthorizer becomes public.
+func defaultAuthorizer(ctx *context.T) error {
+	var (
+		localNames             = security.LocalBlessingNames(ctx)
+		remoteNames, remoteErr = security.RemoteBlessingNames(ctx)
+	)
+	// Authorize if any element in localNames is a "delegate of" (i.e., has been
+	// blessed by) any element in remoteNames, OR vice-versa.
+	for _, l := range localNames {
+		if security.BlessingPattern(l).MatchedBy(remoteNames...) {
+			// l is a delegate of an element in remote.
+			return nil
+		}
+	}
+	for _, r := range remoteNames {
+		if security.BlessingPattern(r).MatchedBy(localNames...) {
+			// r is a delegate of an element in localNames.
+			return nil
+		}
+	}
+
+	return rpc.NewErrInvalidBlessings(nil, remoteNames, remoteErr, localNames)
+}
diff --git a/services/mgmt/lib/binary/impl.go b/services/mgmt/lib/binary/impl.go
index ae17686..aae347a 100644
--- a/services/mgmt/lib/binary/impl.go
+++ b/services/mgmt/lib/binary/impl.go
@@ -24,8 +24,8 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/binary"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/binary"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 
diff --git a/services/mgmt/lib/binary/impl_test.go b/services/mgmt/lib/binary/impl_test.go
index 49388d7..91523f6 100644
--- a/services/mgmt/lib/binary/impl_test.go
+++ b/services/mgmt/lib/binary/impl_test.go
@@ -16,7 +16,7 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 	"v.io/x/lib/vlog"
 
 	_ "v.io/x/ref/profiles"
diff --git a/services/mgmt/lib/fs/simplestore.go b/services/mgmt/lib/fs/simplestore.go
index 442d327..b1b3179 100644
--- a/services/mgmt/lib/fs/simplestore.go
+++ b/services/mgmt/lib/fs/simplestore.go
@@ -19,7 +19,7 @@
 
 	"v.io/v23/security"
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/v23/verror"
 	"v.io/v23/vom"
 )
diff --git a/services/mgmt/lib/fs/simplestore_test.go b/services/mgmt/lib/fs/simplestore_test.go
index df723d3..4d10f66 100644
--- a/services/mgmt/lib/fs/simplestore_test.go
+++ b/services/mgmt/lib/fs/simplestore_test.go
@@ -12,7 +12,7 @@
 	"testing"
 
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/v23/verror"
 	"v.io/x/ref/services/mgmt/lib/fs"
 	_ "v.io/x/ref/services/mgmt/profile"
diff --git a/services/mgmt/lib/packages/packages.go b/services/mgmt/lib/packages/packages.go
index 26b7584..2522a04 100644
--- a/services/mgmt/lib/packages/packages.go
+++ b/services/mgmt/lib/packages/packages.go
@@ -17,7 +17,7 @@
 	"path/filepath"
 	"strings"
 
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 	"v.io/v23/verror"
 )
 
diff --git a/services/mgmt/lib/packages/packages_test.go b/services/mgmt/lib/packages/packages_test.go
index 247ab80..43a062d 100644
--- a/services/mgmt/lib/packages/packages_test.go
+++ b/services/mgmt/lib/packages/packages_test.go
@@ -16,7 +16,7 @@
 	"sort"
 	"testing"
 
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/repository"
 
 	"v.io/x/ref/services/mgmt/lib/packages"
 )
diff --git a/services/mgmt/lib/testutil/modules.go b/services/mgmt/lib/testutil/modules.go
index 3337061..9fa84fc 100644
--- a/services/mgmt/lib/testutil/modules.go
+++ b/services/mgmt/lib/testutil/modules.go
@@ -68,7 +68,7 @@
 
 // startRootMT sets up a root mount table for tests.
 func startRootMT(t *testing.T, sh *modules.Shell) (string, modules.Handle) {
-	h, err := sh.Start("rootMT", nil, "--veyron.tcp.address=127.0.0.1:0")
+	h, err := sh.Start("rootMT", nil, "--v23.tcp.address=127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("failed to start root mount table: %s", err)
 	}
diff --git a/services/mgmt/logreader/impl/logfile.go b/services/mgmt/logreader/impl/logfile.go
index b1eb185..10d9db4 100644
--- a/services/mgmt/logreader/impl/logfile.go
+++ b/services/mgmt/logreader/impl/logfile.go
@@ -3,9 +3,9 @@
 // license that can be found in the LICENSE file.
 
 // Package impl implements the LogFile interface from
-// v.io/v23/services/mgmt/logreader, which can be used to allow remote access to
-// log files, and the Globbable interface from v.io/v23/services/mounttable to
-// find the files in a logs directory.
+// v.io/v23/services/logreader, which can be used to allow remote access to log
+// files, and the Globbable interface from v.io/v23/services/mounttable to find
+// the files in a logs directory.
 package impl
 
 import (
@@ -16,7 +16,7 @@
 	"strings"
 
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/logreader"
+	"v.io/v23/services/logreader"
 	"v.io/v23/verror"
 	"v.io/x/lib/vlog"
 )
diff --git a/services/mgmt/logreader/impl/logfile_test.go b/services/mgmt/logreader/impl/logfile_test.go
index fa3081a..8e9d229 100644
--- a/services/mgmt/logreader/impl/logfile_test.go
+++ b/services/mgmt/logreader/impl/logfile_test.go
@@ -15,7 +15,7 @@
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/logreader"
+	"v.io/v23/services/logreader"
 	"v.io/v23/verror"
 
 	_ "v.io/x/ref/profiles"
diff --git a/services/mgmt/pprof/client/proxy.go b/services/mgmt/pprof/client/proxy.go
index 6a1086a..eab49fc 100644
--- a/services/mgmt/pprof/client/proxy.go
+++ b/services/mgmt/pprof/client/proxy.go
@@ -21,7 +21,7 @@
 	"time"
 
 	"v.io/v23/context"
-	"v.io/v23/services/mgmt/pprof"
+	"v.io/v23/services/pprof"
 	"v.io/v23/vtrace"
 )
 
diff --git a/services/mgmt/pprof/impl/server.go b/services/mgmt/pprof/impl/server.go
index 3693b63..a373cbf 100644
--- a/services/mgmt/pprof/impl/server.go
+++ b/services/mgmt/pprof/impl/server.go
@@ -12,7 +12,7 @@
 	"time"
 
 	"v.io/v23/rpc"
-	spprof "v.io/v23/services/mgmt/pprof"
+	spprof "v.io/v23/services/pprof"
 	"v.io/v23/verror"
 )
 
diff --git a/services/mgmt/profile/profile.vdl b/services/mgmt/profile/profile.vdl
index 462b230..5b783b7 100644
--- a/services/mgmt/profile/profile.vdl
+++ b/services/mgmt/profile/profile.vdl
@@ -6,7 +6,7 @@
 // types used by the implementation of Vanadium profiles.
 package profile
 
-import "v.io/v23/services/mgmt/build"
+import "v.io/v23/services/build"
 
 // Library describes a shared library that applications may use.
 type Library struct {
diff --git a/services/mgmt/profile/profile.vdl.go b/services/mgmt/profile/profile.vdl.go
index f6268ee..b64bd42 100644
--- a/services/mgmt/profile/profile.vdl.go
+++ b/services/mgmt/profile/profile.vdl.go
@@ -14,7 +14,7 @@
 	"v.io/v23/vdl"
 
 	// VDL user imports
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/build"
 )
 
 // Library describes a shared library that applications may use.
diff --git a/services/mgmt/profile/profiled/impl_test.go b/services/mgmt/profile/profiled/impl_test.go
index ba1c88b..0a92df8 100644
--- a/services/mgmt/profile/profiled/impl_test.go
+++ b/services/mgmt/profile/profiled/impl_test.go
@@ -12,7 +12,7 @@
 
 	"v.io/v23"
 	"v.io/v23/naming"
-	"v.io/v23/services/mgmt/build"
+	"v.io/v23/services/build"
 
 	"v.io/x/ref/services/mgmt/profile"
 	"v.io/x/ref/services/mgmt/repository"
diff --git a/services/mgmt/profile/profiled/profiled_v23_test.go b/services/mgmt/profile/profiled/profiled_v23_test.go
index bcb5ecd..073076c 100644
--- a/services/mgmt/profile/profiled/profiled_v23_test.go
+++ b/services/mgmt/profile/profiled/profiled_v23_test.go
@@ -45,14 +45,14 @@
 }
 
 func V23TestProfileRepository(i *v23tests.T) {
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0")
 
 	// Start the profile repository.
 	profileRepoName := "test-profile-repo"
 	profileRepoStore := i.NewTempDir()
 	args := []string{
 		"-name=" + profileRepoName, "-store=" + profileRepoStore,
-		"-veyron.tcp.address=127.0.0.1:0",
+		"-v23.tcp.address=127.0.0.1:0",
 	}
 	i.BuildV23Pkg("v.io/x/ref/services/mgmt/profile/profiled").Start(args...)
 
diff --git a/services/mgmt/repository/repository.vdl b/services/mgmt/repository/repository.vdl
index 4f6f1b3..8b8f879 100644
--- a/services/mgmt/repository/repository.vdl
+++ b/services/mgmt/repository/repository.vdl
@@ -8,9 +8,9 @@
 
 import (
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
+	"v.io/v23/services/application"
 	"v.io/x/ref/services/mgmt/profile"
-	public "v.io/v23/services/mgmt/repository"
+	public "v.io/v23/services/repository"
 )
 
 // Application describes an application repository internally. Besides
diff --git a/services/mgmt/repository/repository.vdl.go b/services/mgmt/repository/repository.vdl.go
index 9341fd1..fe46e75 100644
--- a/services/mgmt/repository/repository.vdl.go
+++ b/services/mgmt/repository/repository.vdl.go
@@ -18,9 +18,9 @@
 
 	// VDL user imports
 	"v.io/v23/security/access"
-	"v.io/v23/services/mgmt/application"
-	"v.io/v23/services/mgmt/repository"
+	"v.io/v23/services/application"
 	"v.io/v23/services/permissions"
+	"v.io/v23/services/repository"
 	"v.io/x/ref/services/mgmt/profile"
 )
 
@@ -63,33 +63,19 @@
 }
 
 // ApplicationClient returns a client stub for Application.
-func ApplicationClient(name string, opts ...rpc.BindOpt) ApplicationClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implApplicationClientStub{name, client, repository.ApplicationClient(name, client)}
+func ApplicationClient(name string) ApplicationClientStub {
+	return implApplicationClientStub{name, repository.ApplicationClient(name)}
 }
 
 type implApplicationClientStub struct {
-	name   string
-	client rpc.Client
+	name string
 
 	repository.ApplicationClientStub
 }
 
-func (c implApplicationClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
-}
-
 func (c implApplicationClientStub) Put(ctx *context.T, i0 []string, i1 application.Envelope, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Put", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Put", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -98,7 +84,7 @@
 
 func (c implApplicationClientStub) Remove(ctx *context.T, i0 string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Remove", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Remove", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -199,7 +185,7 @@
 	PkgPath: "v.io/x/ref/services/mgmt/repository",
 	Doc:     "// Application describes an application repository internally. Besides\n// the public Application interface, it allows to add and remove\n// application envelopes.",
 	Embeds: []rpc.EmbedDesc{
-		{"Application", "v.io/v23/services/mgmt/repository", "// Application provides access to application envelopes. An\n// application envelope is identified by an application name and an\n// application version, which are specified through the object name,\n// and a profile name, which is specified using a method argument.\n//\n// Example:\n// /apps/search/v1.Match([]string{\"base\", \"media\"})\n//   returns an application envelope that can be used for downloading\n//   and executing the \"search\" application, version \"v1\", runnable\n//   on either the \"base\" or \"media\" profile."},
+		{"Application", "v.io/v23/services/repository", "// Application provides access to application envelopes. An\n// application envelope is identified by an application name and an\n// application version, which are specified through the object name,\n// and a profile name, which is specified using a method argument.\n//\n// Example:\n// /apps/search/v1.Match([]string{\"base\", \"media\"})\n//   returns an application envelope that can be used for downloading\n//   and executing the \"search\" application, version \"v1\", runnable\n//   on either the \"base\" or \"media\" profile."},
 	},
 	Methods: []rpc.MethodDesc{
 		{
@@ -251,33 +237,19 @@
 }
 
 // ProfileClient returns a client stub for Profile.
-func ProfileClient(name string, opts ...rpc.BindOpt) ProfileClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implProfileClientStub{name, client, repository.ProfileClient(name, client)}
+func ProfileClient(name string) ProfileClientStub {
+	return implProfileClientStub{name, repository.ProfileClient(name)}
 }
 
 type implProfileClientStub struct {
-	name   string
-	client rpc.Client
+	name string
 
 	repository.ProfileClientStub
 }
 
-func (c implProfileClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
-}
-
 func (c implProfileClientStub) Specification(ctx *context.T, opts ...rpc.CallOpt) (o0 profile.Specification, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Specification", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Specification", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -286,7 +258,7 @@
 
 func (c implProfileClientStub) Put(ctx *context.T, i0 profile.Specification, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Put", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Put", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -295,7 +267,7 @@
 
 func (c implProfileClientStub) Remove(ctx *context.T, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Remove", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Remove", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -390,7 +362,7 @@
 	PkgPath: "v.io/x/ref/services/mgmt/repository",
 	Doc:     "// Profile describes a profile internally. Besides the public Profile\n// interface, it allows to add and remove profile specifications.",
 	Embeds: []rpc.EmbedDesc{
-		{"Profile", "v.io/v23/services/mgmt/repository", "// Profile abstracts a device's ability to run binaries, and hides\n// specifics such as the operating system, hardware architecture, and\n// the set of installed libraries. Profiles describe binaries and\n// devices, and are used to match them."},
+		{"Profile", "v.io/v23/services/repository", "// Profile abstracts a device's ability to run binaries, and hides\n// specifics such as the operating system, hardware architecture, and\n// the set of installed libraries. Profiles describe binaries and\n// devices, and are used to match them."},
 	},
 	Methods: []rpc.MethodDesc{
 		{
diff --git a/services/mgmt/stats/impl/stats.go b/services/mgmt/stats/impl/stats.go
index 6a39a45..503420a 100644
--- a/services/mgmt/stats/impl/stats.go
+++ b/services/mgmt/stats/impl/stats.go
@@ -3,7 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // Package impl implements the Stats interface from
-// v.io/v23/services/mgmt/stats.
+// v.io/v23/services/stats.
 package impl
 
 import (
@@ -14,7 +14,7 @@
 
 	"v.io/v23/naming"
 	"v.io/v23/rpc"
-	"v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/stats"
 	"v.io/v23/services/watch"
 	"v.io/v23/vdl"
 	"v.io/v23/verror"
diff --git a/services/mgmt/stats/impl/stats_test.go b/services/mgmt/stats/impl/stats_test.go
index 02e2f7c..ca5a184 100644
--- a/services/mgmt/stats/impl/stats_test.go
+++ b/services/mgmt/stats/impl/stats_test.go
@@ -14,7 +14,7 @@
 	"v.io/v23/context"
 	"v.io/v23/naming"
 	"v.io/v23/security"
-	"v.io/v23/services/mgmt/stats"
+	"v.io/v23/services/stats"
 	"v.io/v23/services/watch"
 	"v.io/v23/vdl"
 
diff --git a/services/mgmt/suidhelper/impl/args.go b/services/mgmt/suidhelper/impl/args.go
index f124081..8081a26 100644
--- a/services/mgmt/suidhelper/impl/args.go
+++ b/services/mgmt/suidhelper/impl/args.go
@@ -46,7 +46,7 @@
 	LogDir   string
 }
 
-const SavedArgs = "VEYRON_SAVED_ARGS"
+const SavedArgs = "V23_SAVED_ARGS"
 
 var (
 	flagUsername, flagWorkspace, flagLogDir, flagRun, flagProgName *string
diff --git a/services/mgmt/vtrace/impl/vtrace.go b/services/mgmt/vtrace/impl/vtrace.go
index c5ca6b2..b9e54b5 100644
--- a/services/mgmt/vtrace/impl/vtrace.go
+++ b/services/mgmt/vtrace/impl/vtrace.go
@@ -6,7 +6,7 @@
 
 import (
 	"v.io/v23/rpc"
-	svtrace "v.io/v23/services/mgmt/vtrace"
+	s_vtrace "v.io/v23/services/vtrace"
 	"v.io/v23/uniqueid"
 	"v.io/v23/verror"
 	"v.io/v23/vtrace"
@@ -23,7 +23,7 @@
 	return *tr, nil
 }
 
-func (v *vtraceService) AllTraces(call svtrace.StoreAllTracesServerCall) error {
+func (v *vtraceService) AllTraces(call s_vtrace.StoreAllTracesServerCall) error {
 	// TODO(mattr): Consider changing the store to allow us to iterate through traces
 	// when there are many.
 	store := vtrace.GetStore(call.Context())
@@ -37,5 +37,5 @@
 }
 
 func NewVtraceService() interface{} {
-	return svtrace.StoreServer(&vtraceService{})
+	return s_vtrace.StoreServer(&vtraceService{})
 }
diff --git a/services/mgmt/vtrace/impl/vtrace_test.go b/services/mgmt/vtrace/impl/vtrace_test.go
index 1084e5f..1134981 100644
--- a/services/mgmt/vtrace/impl/vtrace_test.go
+++ b/services/mgmt/vtrace/impl/vtrace_test.go
@@ -9,7 +9,7 @@
 	"testing"
 
 	"v.io/v23"
-	service "v.io/v23/services/mgmt/vtrace"
+	s_vtrace "v.io/v23/services/vtrace"
 	"v.io/v23/vtrace"
 
 	_ "v.io/x/ref/profiles"
@@ -40,7 +40,7 @@
 	span.Finish()
 	id := span.Trace()
 
-	client := service.StoreClient(endpoints[0].Name())
+	client := s_vtrace.StoreClient(endpoints[0].Name())
 
 	sctx, _ = vtrace.SetNewTrace(sctx)
 	trace, err := client.Trace(sctx, id)
diff --git a/services/mounttable/lib/collection_test_interface.vdl.go b/services/mounttable/lib/collection_test_interface.vdl.go
index c9036a3..71b5369 100644
--- a/services/mounttable/lib/collection_test_interface.vdl.go
+++ b/services/mounttable/lib/collection_test_interface.vdl.go
@@ -34,31 +34,17 @@
 }
 
 // CollectionClient returns a client stub for Collection.
-func CollectionClient(name string, opts ...rpc.BindOpt) CollectionClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implCollectionClientStub{name, client}
+func CollectionClient(name string) CollectionClientStub {
+	return implCollectionClientStub{name}
 }
 
 type implCollectionClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implCollectionClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implCollectionClientStub) Export(ctx *context.T, i0 string, i1 bool, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Export", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Export", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -67,7 +53,7 @@
 
 func (c implCollectionClientStub) Lookup(ctx *context.T, opts ...rpc.CallOpt) (o0 []byte, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Lookup", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Lookup", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/services/mounttable/mounttabled/mounttabled_v23_test.go b/services/mounttable/mounttabled/mounttabled_v23_test.go
index e1b6d91..57bc59a 100644
--- a/services/mounttable/mounttabled/mounttabled_v23_test.go
+++ b/services/mounttable/mounttabled/mounttabled_v23_test.go
@@ -35,7 +35,7 @@
 
 func V23TestMount(i *v23tests.T) {
 	neighborhood := fmt.Sprintf("test-%s-%d", getHostname(i), os.Getpid())
-	v23tests.RunRootMT(i, "--veyron.tcp.address=127.0.0.1:0", "--neighborhood_name="+neighborhood)
+	v23tests.RunRootMT(i, "--v23.tcp.address=127.0.0.1:0", "--neighborhood_name="+neighborhood)
 
 	name, _ := i.GetVar(envvar.NamespacePrefix)
 	clientBin := binaryWithCredentials(i, "cmd", "v.io/x/ref/cmd/mounttable")
diff --git a/services/proxy/proxyd/proxyd_v23_test.go b/services/proxy/proxyd/proxyd_v23_test.go
index 2723e51..795ade3 100644
--- a/services/proxy/proxyd/proxyd_v23_test.go
+++ b/services/proxy/proxyd/proxyd_v23_test.go
@@ -33,7 +33,7 @@
 }
 
 func V23TestProxyd(t *v23tests.T) {
-	v23tests.RunRootMT(t, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(t, "--v23.tcp.address=127.0.0.1:0")
 	var (
 		proxydCreds, _ = t.Shell().NewChildCredentials("proxyd")
 		serverCreds, _ = t.Shell().NewChildCredentials("server")
@@ -42,7 +42,7 @@
 	)
 	// Start proxyd
 	proxyd.WithStartOpts(proxyd.StartOpts().WithCustomCredentials(proxydCreds)).
-		Start("--veyron.tcp.address=127.0.0.1:0", "--name="+proxyName)
+		Start("--v23.tcp.address=127.0.0.1:0", "--name="+proxyName)
 	// Start the server that only listens via the proxy
 	if _, err := t.Shell().StartWithOpts(
 		t.Shell().DefaultStartOpts().WithCustomCredentials(serverCreds),
diff --git a/services/security/discharger.vdl.go b/services/security/discharger.vdl.go
index 5645357..3b0715a 100644
--- a/services/security/discharger.vdl.go
+++ b/services/security/discharger.vdl.go
@@ -51,31 +51,17 @@
 }
 
 // DischargerClient returns a client stub for Discharger.
-func DischargerClient(name string, opts ...rpc.BindOpt) DischargerClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implDischargerClientStub{name, client}
+func DischargerClient(name string) DischargerClientStub {
+	return implDischargerClientStub{name}
 }
 
 type implDischargerClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implDischargerClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implDischargerClientStub) Discharge(ctx *context.T, i0 security.Caveat, i1 security.DischargeImpetus, opts ...rpc.CallOpt) (o0 security.Discharge, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Discharge", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Discharge", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/services/security/groups/grpserverd/main.go b/services/security/groups/grpserverd/main.go
index dab3768..b5d2c3d 100644
--- a/services/security/groups/grpserverd/main.go
+++ b/services/security/groups/grpserverd/main.go
@@ -6,7 +6,7 @@
 package main
 
 // Example invocation:
-// grpserverd --veyron.tcp.address="127.0.0.1:0" --name=grpserverd
+// grpserverd --v23.tcp.address="127.0.0.1:0" --name=grpserverd
 
 import (
 	"flag"
diff --git a/services/security/role.vdl.go b/services/security/role.vdl.go
index b90bb48..e15db68 100644
--- a/services/security/role.vdl.go
+++ b/services/security/role.vdl.go
@@ -44,31 +44,17 @@
 }
 
 // RoleClient returns a client stub for Role.
-func RoleClient(name string, opts ...rpc.BindOpt) RoleClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implRoleClientStub{name, client}
+func RoleClient(name string) RoleClientStub {
+	return implRoleClientStub{name}
 }
 
 type implRoleClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implRoleClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implRoleClientStub) SeekBlessings(ctx *context.T, opts ...rpc.CallOpt) (o0 security.Blessings, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "SeekBlessings", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "SeekBlessings", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/services/security/roled/internal/role.go b/services/security/roled/internal/role.go
index 3941329..c3e8b24 100644
--- a/services/security/roled/internal/role.go
+++ b/services/security/roled/internal/role.go
@@ -5,6 +5,7 @@
 package internal
 
 import (
+	"strings"
 	"time"
 
 	"v.io/v23"
@@ -14,6 +15,8 @@
 	"v.io/v23/verror"
 
 	"v.io/x/lib/vlog"
+
+	isecurity "v.io/x/ref/services/security"
 )
 
 var (
@@ -71,6 +74,7 @@
 	}
 	var extensions []string
 	for _, b := range blessingNames {
+		b = strings.TrimSuffix(b, security.ChainSeparator+isecurity.RoleSuffix)
 		extensions = append(extensions, role+security.ChainSeparator+b)
 	}
 	return extensions
diff --git a/services/security/roled/internal/role_test.go b/services/security/roled/internal/role_test.go
index 3ced6b1..583bd98 100644
--- a/services/security/roled/internal/role_test.go
+++ b/services/security/roled/internal/role_test.go
@@ -89,9 +89,9 @@
 		{user3, "unknown", verror.ErrNoAccess.ID, nil},
 
 		{user1, "A", verror.ErrNoAccess.ID, nil},
-		{user1R, "A", noErr, []string{"root/roles/A/root/users/user1/_role"}},
+		{user1R, "A", noErr, []string{"root/roles/A/root/users/user1"}},
 		{user2, "A", verror.ErrNoAccess.ID, nil},
-		{user2R, "A", noErr, []string{"root/roles/A/root/users/user2/_role"}},
+		{user2R, "A", noErr, []string{"root/roles/A/root/users/user2"}},
 		{user3, "A", verror.ErrNoAccess.ID, nil},
 		{user3R, "A", noErr, []string{"root/roles/A/root/users/user3/_role/bar", "root/roles/A/root/users/user3/_role/foo"}},
 
diff --git a/services/wsprd/app/controller.vdl.go b/services/wsprd/app/controller.vdl.go
index 6a985c7..ccb8ee0 100644
--- a/services/wsprd/app/controller.vdl.go
+++ b/services/wsprd/app/controller.vdl.go
@@ -52,31 +52,17 @@
 }
 
 // ControllerClient returns a client stub for Controller.
-func ControllerClient(name string, opts ...rpc.BindOpt) ControllerClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implControllerClientStub{name, client}
+func ControllerClient(name string) ControllerClientStub {
+	return implControllerClientStub{name}
 }
 
 type implControllerClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implControllerClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implControllerClientStub) Serve(ctx *context.T, i0 string, i1 uint32, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Serve", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Serve", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -85,7 +71,7 @@
 
 func (c implControllerClientStub) Stop(ctx *context.T, i0 uint32, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Stop", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Stop", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -94,7 +80,7 @@
 
 func (c implControllerClientStub) AddName(ctx *context.T, i0 uint32, i1 string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "AddName", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "AddName", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -103,7 +89,7 @@
 
 func (c implControllerClientStub) RemoveName(ctx *context.T, i0 uint32, i1 string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "RemoveName", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "RemoveName", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -112,7 +98,7 @@
 
 func (c implControllerClientStub) UnlinkBlessings(ctx *context.T, i0 principal.BlessingsHandle, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "UnlinkBlessings", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "UnlinkBlessings", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -121,7 +107,7 @@
 
 func (c implControllerClientStub) Bless(ctx *context.T, i0 string, i1 principal.BlessingsHandle, i2 string, i3 []security.Caveat, opts ...rpc.CallOpt) (o0 string, o1 principal.BlessingsHandle, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Bless", []interface{}{i0, i1, i2, i3}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Bless", []interface{}{i0, i1, i2, i3}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0, &o1)
@@ -130,7 +116,7 @@
 
 func (c implControllerClientStub) BlessSelf(ctx *context.T, i0 string, i1 []security.Caveat, opts ...rpc.CallOpt) (o0 string, o1 principal.BlessingsHandle, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "BlessSelf", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "BlessSelf", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0, &o1)
@@ -139,7 +125,7 @@
 
 func (c implControllerClientStub) RemoteBlessings(ctx *context.T, i0 string, i1 string, opts ...rpc.CallOpt) (o0 []string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "RemoteBlessings", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "RemoteBlessings", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -148,7 +134,7 @@
 
 func (c implControllerClientStub) Signature(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 []signature.Interface, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Signature", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Signature", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
diff --git a/services/wsprd/namespace/namespace.vdl.go b/services/wsprd/namespace/namespace.vdl.go
index 2ea27e2..14ac360 100644
--- a/services/wsprd/namespace/namespace.vdl.go
+++ b/services/wsprd/namespace/namespace.vdl.go
@@ -62,31 +62,17 @@
 }
 
 // NamespaceClient returns a client stub for Namespace.
-func NamespaceClient(name string, opts ...rpc.BindOpt) NamespaceClientStub {
-	var client rpc.Client
-	for _, opt := range opts {
-		if clientOpt, ok := opt.(rpc.Client); ok {
-			client = clientOpt
-		}
-	}
-	return implNamespaceClientStub{name, client}
+func NamespaceClient(name string) NamespaceClientStub {
+	return implNamespaceClientStub{name}
 }
 
 type implNamespaceClientStub struct {
-	name   string
-	client rpc.Client
-}
-
-func (c implNamespaceClientStub) c(ctx *context.T) rpc.Client {
-	if c.client != nil {
-		return c.client
-	}
-	return v23.GetClient(ctx)
+	name string
 }
 
 func (c implNamespaceClientStub) Glob(ctx *context.T, i0 string, opts ...rpc.CallOpt) (ocall NamespaceGlobClientCall, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Glob", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Glob", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	ocall = &implNamespaceGlobClientCall{ClientCall: call}
@@ -95,7 +81,7 @@
 
 func (c implNamespaceClientStub) Mount(ctx *context.T, i0 string, i1 string, i2 time.Duration, i3 bool, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Mount", []interface{}{i0, i1, i2, i3}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Mount", []interface{}{i0, i1, i2, i3}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -104,7 +90,7 @@
 
 func (c implNamespaceClientStub) Unmount(ctx *context.T, i0 string, i1 string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Unmount", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Unmount", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -113,7 +99,7 @@
 
 func (c implNamespaceClientStub) Resolve(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 []string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Resolve", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Resolve", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -122,7 +108,7 @@
 
 func (c implNamespaceClientStub) ResolveToMountTable(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 []string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "ResolveToMountTable", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "ResolveToMountTable", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -131,7 +117,7 @@
 
 func (c implNamespaceClientStub) FlushCacheEntry(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 bool, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "FlushCacheEntry", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "FlushCacheEntry", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -140,7 +126,7 @@
 
 func (c implNamespaceClientStub) DisableCache(ctx *context.T, i0 bool, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "DisableCache", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "DisableCache", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -149,7 +135,7 @@
 
 func (c implNamespaceClientStub) Roots(ctx *context.T, opts ...rpc.CallOpt) (o0 []string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Roots", nil, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Roots", nil, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0)
@@ -158,7 +144,7 @@
 
 func (c implNamespaceClientStub) SetRoots(ctx *context.T, i0 []string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "SetRoots", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "SetRoots", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -167,7 +153,7 @@
 
 func (c implNamespaceClientStub) SetPermissions(ctx *context.T, i0 string, i1 access.Permissions, i2 string, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "SetPermissions", []interface{}{i0, i1, i2}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "SetPermissions", []interface{}{i0, i1, i2}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
@@ -176,7 +162,7 @@
 
 func (c implNamespaceClientStub) GetPermissions(ctx *context.T, i0 string, opts ...rpc.CallOpt) (o0 access.Permissions, o1 string, err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "GetPermissions", []interface{}{i0}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "GetPermissions", []interface{}{i0}, opts...); err != nil {
 		return
 	}
 	err = call.Finish(&o0, &o1)
@@ -185,7 +171,7 @@
 
 func (c implNamespaceClientStub) Delete(ctx *context.T, i0 string, i1 bool, opts ...rpc.CallOpt) (err error) {
 	var call rpc.ClientCall
-	if call, err = c.c(ctx).StartCall(ctx, c.name, "Delete", []interface{}{i0, i1}, opts...); err != nil {
+	if call, err = v23.GetClient(ctx).StartCall(ctx, c.name, "Delete", []interface{}{i0, i1}, opts...); err != nil {
 		return
 	}
 	err = call.Finish()
diff --git a/services/wsprd/namespace/request_handler.go b/services/wsprd/namespace/request_handler.go
index 79629c9..3df6813 100644
--- a/services/wsprd/namespace/request_handler.go
+++ b/services/wsprd/namespace/request_handler.go
@@ -49,7 +49,7 @@
 }
 
 func (s *Server) Mount(call rpc.ServerCall, name, server string, ttl time.Duration, replace bool) error {
-	rmOpt := naming.ReplaceMountOpt(replace)
+	rmOpt := naming.ReplaceMount(replace)
 	err := s.ns.Mount(call.Context(), name, server, ttl, rmOpt)
 	if err != nil {
 		err = verror.Convert(verror.ErrInternal, call.Context(), err)
diff --git a/test/v23tests/v23tests_test.go b/test/v23tests/v23tests_test.go
index f14eade..f3c5382 100644
--- a/test/v23tests/v23tests_test.go
+++ b/test/v23tests/v23tests_test.go
@@ -50,7 +50,7 @@
 	env := v23tests.New(t)
 	defer env.Cleanup()
 
-	v23tests.RunRootMT(env, "--veyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(env, "--v23.tcp.address=127.0.0.1:0")
 	proxyBin := env.BuildV23Pkg("v.io/x/ref/services/proxy/proxyd")
 	nsBin := env.BuildGoPkg("v.io/x/ref/cmd/namespace")
 
@@ -59,7 +59,7 @@
 		t.Fatalf("expected a mount table name")
 	}
 
-	proxy := proxyBin.Start("--veyron.tcp.address=127.0.0.1:0", "-name=proxyd")
+	proxy := proxyBin.Start("--v23.tcp.address=127.0.0.1:0", "-name=proxyd")
 	proxyName := proxy.ExpectVar("NAME")
 	proxyAddress, _ := naming.SplitAddressName(proxyName)
 
@@ -315,7 +315,7 @@
 			t.Fatalf("%q does not contain %q", got, want)
 		}
 	}()
-	v23tests.RunRootMT(env, "--xxveyron.tcp.address=127.0.0.1:0")
+	v23tests.RunRootMT(env, "--xxv23.tcp.address=127.0.0.1:0")
 }
 
 func TestWaitTimeout(t *testing.T) {