x/ref/services: convert more services to context based logging.

Change-Id: I156933edb15b10f9b8f238188a1cc3caccfd0780
diff --git a/lib/security/audit/auditor.go b/lib/security/audit/auditor.go
index c73c9c7..52eddaa 100644
--- a/lib/security/audit/auditor.go
+++ b/lib/security/audit/auditor.go
@@ -13,11 +13,13 @@
 	"fmt"
 	"strings"
 	"time"
+
+	"v.io/v23/context"
 )
 
 // Auditor is the interface for writing auditable events.
 type Auditor interface {
-	Audit(entry Entry) error
+	Audit(ctx *context.T, entry Entry) error
 }
 
 // Entry is the information logged on each auditable event.
diff --git a/lib/security/audit/principal.go b/lib/security/audit/principal.go
index 3afb385..60d4a78 100644
--- a/lib/security/audit/principal.go
+++ b/lib/security/audit/principal.go
@@ -7,6 +7,8 @@
 import (
 	"time"
 
+	"v.io/v23"
+	"v.io/v23/context"
 	"v.io/v23/security"
 	"v.io/v23/verror"
 )
@@ -20,13 +22,15 @@
 // NewPrincipal returns a security.Principal implementation that logs
 // all private key operations of 'wrapped' to 'auditor' (i.e., all calls to
 // BlessSelf, Bless, MintDischarge and Sign).
-func NewPrincipal(wrapped security.Principal, auditor Auditor) security.Principal {
-	return &auditingPrincipal{wrapped, auditor}
+func NewPrincipal(ctx *context.T, auditor Auditor) security.Principal {
+	wrapped := v23.GetPrincipal(ctx)
+	return &auditingPrincipal{principal: wrapped, auditor: auditor, ctx: ctx}
 }
 
 type auditingPrincipal struct {
 	principal security.Principal
 	auditor   Auditor
+	ctx       *context.T
 }
 
 type args []interface{}
@@ -91,7 +95,7 @@
 	if result != nil {
 		entry.Results = []interface{}{result}
 	}
-	if err := p.auditor.Audit(entry); err != nil {
+	if err := p.auditor.Audit(p.ctx, entry); err != nil {
 		return verror.New(errCantAuditCall, nil, method, err)
 	}
 	return nil
diff --git a/lib/security/audit/principal_test.go b/lib/security/audit/principal_test.go
index 7094739..cec8999 100644
--- a/lib/security/audit/principal_test.go
+++ b/lib/security/audit/principal_test.go
@@ -15,20 +15,27 @@
 	"testing"
 	"time"
 
+	"v.io/v23"
+	"v.io/v23/context"
 	"v.io/v23/security"
 	"v.io/v23/verror"
 	"v.io/x/ref/lib/security/audit"
+	_ "v.io/x/ref/runtime/factories/fake"
+	"v.io/x/ref/test"
 )
 
 func TestAuditingPrincipal(t *testing.T) {
+	ctx, shutdown := test.V23InitWithParams(test.InitParams{})
+	defer shutdown()
 	var (
 		thirdPartyCaveat, discharge = newThirdPartyCaveatAndDischarge(t)
 		wantErr                     = errors.New("call failed") // The error returned by call calls to mockID operations
 
 		mockP   = new(mockPrincipal)
 		auditor = new(mockAuditor)
-		p       = audit.NewPrincipal(mockP, auditor)
 	)
+	ctx, _ = v23.WithPrincipal(ctx, mockP)
+	p := audit.NewPrincipal(ctx, auditor)
 	tests := []struct {
 		Method      string
 		Args        V
@@ -122,11 +129,14 @@
 }
 
 func TestUnauditedMethodsOnPrincipal(t *testing.T) {
+	ctx, shutdown := test.V23InitWithParams(test.InitParams{})
+	defer shutdown()
 	var (
-		auditor  = new(mockAuditor)
-		p        = newPrincipal(t)
-		auditedP = audit.NewPrincipal(p, auditor)
+		auditor = new(mockAuditor)
+		p       = newPrincipal(t)
 	)
+	ctx, _ = v23.WithPrincipal(ctx, p)
+	auditedP := audit.NewPrincipal(ctx, auditor)
 	blessing, err := p.BlessSelf("self")
 	if err != nil {
 		t.Fatal(err)
@@ -212,7 +222,7 @@
 	NextError error
 }
 
-func (a *mockAuditor) Audit(entry audit.Entry) error {
+func (a *mockAuditor) Audit(ctx *context.T, entry audit.Entry) error {
 	if a.NextError != nil {
 		err := a.NextError
 		a.NextError = nil
diff --git a/services/binary/binary/impl_test.go b/services/binary/binary/impl_test.go
index ecd41fd..6cf5fd0 100644
--- a/services/binary/binary/impl_test.go
+++ b/services/binary/binary/impl_test.go
@@ -23,7 +23,6 @@
 	"v.io/v23/services/binary"
 	"v.io/v23/services/repository"
 	"v.io/x/lib/cmdline"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/v23cmd"
 	"v.io/x/ref/lib/xrpc"
 	_ "v.io/x/ref/runtime/factories/generic"
@@ -36,37 +35,37 @@
 	suffix string
 }
 
-func (s *server) Create(*context.T, rpc.ServerCall, int32, repository.MediaInfo) error {
-	vlog.Infof("Create() was called. suffix=%v", s.suffix)
+func (s *server) Create(ctx *context.T, _ rpc.ServerCall, _ int32, _ repository.MediaInfo) error {
+	ctx.Infof("Create() was called. suffix=%v", s.suffix)
 	return nil
 }
 
-func (s *server) Delete(*context.T, rpc.ServerCall) error {
-	vlog.Infof("Delete() was called. suffix=%v", s.suffix)
+func (s *server) Delete(ctx *context.T, _ rpc.ServerCall) error {
+	ctx.Infof("Delete() was called. suffix=%v", s.suffix)
 	if s.suffix != "exists" {
 		return fmt.Errorf("binary doesn't exist: %v", s.suffix)
 	}
 	return nil
 }
 
-func (s *server) Download(_ *context.T, call repository.BinaryDownloadServerCall, _ int32) error {
-	vlog.Infof("Download() was called. suffix=%v", s.suffix)
+func (s *server) Download(ctx *context.T, call repository.BinaryDownloadServerCall, _ int32) error {
+	ctx.Infof("Download() was called. suffix=%v", s.suffix)
 	sender := call.SendStream()
 	sender.Send([]byte("Hello"))
 	sender.Send([]byte("World"))
 	return nil
 }
 
-func (s *server) DownloadUrl(*context.T, rpc.ServerCall) (string, int64, error) {
-	vlog.Infof("DownloadUrl() was called. suffix=%v", s.suffix)
+func (s *server) DownloadUrl(ctx *context.T, _ rpc.ServerCall) (string, int64, error) {
+	ctx.Infof("DownloadUrl() was called. suffix=%v", s.suffix)
 	if s.suffix != "" {
 		return "", 0, fmt.Errorf("non-empty suffix: %v", s.suffix)
 	}
 	return "test-download-url", 0, nil
 }
 
-func (s *server) Stat(*context.T, rpc.ServerCall) ([]binary.PartInfo, repository.MediaInfo, error) {
-	vlog.Infof("Stat() was called. suffix=%v", s.suffix)
+func (s *server) Stat(ctx *context.T, _ rpc.ServerCall) ([]binary.PartInfo, repository.MediaInfo, error) {
+	ctx.Infof("Stat() was called. suffix=%v", s.suffix)
 	h := md5.New()
 	text := "HelloWorld"
 	h.Write([]byte(text))
@@ -74,19 +73,19 @@
 	return []binary.PartInfo{part}, repository.MediaInfo{Type: "text/plain"}, nil
 }
 
-func (s *server) Upload(_ *context.T, call repository.BinaryUploadServerCall, _ int32) error {
-	vlog.Infof("Upload() was called. suffix=%v", s.suffix)
+func (s *server) Upload(ctx *context.T, call repository.BinaryUploadServerCall, _ int32) error {
+	ctx.Infof("Upload() was called. suffix=%v", s.suffix)
 	rStream := call.RecvStream()
 	for rStream.Advance() {
 	}
 	return nil
 }
 
-func (s *server) GetPermissions(*context.T, rpc.ServerCall) (perms access.Permissions, version string, err error) {
+func (s *server) GetPermissions(ctx *context.T, _ rpc.ServerCall) (perms access.Permissions, version string, err error) {
 	return nil, "", nil
 }
 
-func (s *server) SetPermissions(_ *context.T, _ rpc.ServerCall, perms access.Permissions, version string) error {
+func (s *server) SetPermissions(ctx *context.T, _ rpc.ServerCall, perms access.Permissions, version string) error {
 	return nil
 }
 
diff --git a/services/binary/binaryd/main.go b/services/binary/binaryd/main.go
index f7788af..d7fc5f1 100644
--- a/services/binary/binaryd/main.go
+++ b/services/binary/binaryd/main.go
@@ -17,7 +17,6 @@
 	"v.io/v23/context"
 	"v.io/x/lib/cmdline"
 	"v.io/x/lib/netstate"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/signals"
 	"v.io/x/ref/lib/v23cmd"
 	"v.io/x/ref/lib/xrpc"
@@ -54,7 +53,7 @@
 	// TODO(caprita): consider using netstate.PossibleAddresses()
 	host, port, err := net.SplitHostPort(addr)
 	if err != nil {
-		vlog.Errorf("SplitHostPort(%v) failed: %v", addr, err)
+		ctx.Errorf("SplitHostPort(%v) failed: %v", addr, err)
 		os.Exit(1)
 	}
 	ip := net.ParseIP(host)
@@ -76,7 +75,7 @@
 	if err != nil {
 		return fmt.Errorf("SetupRootDir(%q) failed: %v", rootDirFlag, err)
 	}
-	vlog.Infof("Binary repository rooted at %v", rootDir)
+	ctx.Infof("Binary repository rooted at %v", rootDir)
 
 	listener, err := net.Listen("tcp", httpAddr)
 	if err != nil {
@@ -87,10 +86,10 @@
 	if err != nil {
 		return fmt.Errorf("NewState(%v, %v, %v) failed: %v", rootDir, rootURL, defaultDepth, err)
 	}
-	vlog.Infof("Binary repository HTTP server at: %q", rootURL)
+	ctx.Infof("Binary repository HTTP server at: %q", rootURL)
 	go func() {
 		if err := http.Serve(listener, http.FileServer(binarylib.NewHTTPRoot(ctx, state))); err != nil {
-			vlog.Errorf("Serve() failed: %v", err)
+			ctx.Errorf("Serve() failed: %v", err)
 			os.Exit(1)
 		}
 	}()
@@ -106,9 +105,9 @@
 	defer server.Stop()
 	epName := server.Status().Endpoints[0].Name()
 	if name != "" {
-		vlog.Infof("Binary repository serving at %q (%q)", name, epName)
+		ctx.Infof("Binary repository serving at %q (%q)", name, epName)
 	} else {
-		vlog.Infof("Binary repository serving at %q", epName)
+		ctx.Infof("Binary repository serving at %q", epName)
 	}
 	// Wait until shutdown.
 	<-signals.ShutdownOnSignals(ctx)
diff --git a/services/build/build/impl_test.go b/services/build/build/impl_test.go
index f3bc90a..2c7ab70 100644
--- a/services/build/build/impl_test.go
+++ b/services/build/build/impl_test.go
@@ -16,7 +16,6 @@
 	"v.io/v23/services/build"
 	"v.io/v23/verror"
 	"v.io/x/lib/cmdline"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/v23cmd"
 	"v.io/x/ref/lib/xrpc"
 	_ "v.io/x/ref/runtime/factories/generic"
@@ -28,19 +27,19 @@
 type mock struct{}
 
 func (mock) Build(ctx *context.T, call build.BuilderBuildServerCall, arch build.Architecture, opsys build.OperatingSystem) ([]byte, error) {
-	vlog.VI(2).Infof("Build(%v, %v) was called", arch, opsys)
+	ctx.VI(2).Infof("Build(%v, %v) was called", arch, opsys)
 	iterator := call.RecvStream()
 	for iterator.Advance() {
 	}
 	if err := iterator.Err(); err != nil {
-		vlog.Errorf("Advance() failed: %v", err)
+		ctx.Errorf("Advance() failed: %v", err)
 		return nil, verror.New(verror.ErrInternal, ctx)
 	}
 	return nil, nil
 }
 
-func (mock) Describe(_ *context.T, _ rpc.ServerCall, name string) (binary.Description, error) {
-	vlog.VI(2).Infof("Describe(%v) was called", name)
+func (mock) Describe(ctx *context.T, _ rpc.ServerCall, name string) (binary.Description, error) {
+	ctx.VI(2).Infof("Describe(%v) was called", name)
 	return binary.Description{}, nil
 }
 
diff --git a/services/build/buildd/main.go b/services/build/buildd/main.go
index 56626d6..cf5cc2d 100644
--- a/services/build/buildd/main.go
+++ b/services/build/buildd/main.go
@@ -14,7 +14,6 @@
 	"v.io/v23/context"
 	"v.io/v23/services/build"
 	"v.io/x/lib/cmdline"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/security/securityflag"
 	"v.io/x/ref/lib/signals"
 	"v.io/x/ref/lib/v23cmd"
@@ -49,7 +48,7 @@
 	if err != nil {
 		return fmt.Errorf("NewServer() failed: %v", err)
 	}
-	vlog.Infof("Build server running at endpoint=%q", server.Status().Endpoints[0].Name())
+	ctx.Infof("Build server running at endpoint=%q", server.Status().Endpoints[0].Name())
 
 	// Wait until shutdown.
 	<-signals.ShutdownOnSignals(ctx)
diff --git a/services/build/buildd/service.go b/services/build/buildd/service.go
index 5e59a13..44ca144 100644
--- a/services/build/buildd/service.go
+++ b/services/build/buildd/service.go
@@ -20,7 +20,6 @@
 	"v.io/v23/services/build"
 	"v.io/v23/verror"
 	"v.io/x/lib/host"
-	"v.io/x/lib/vlog"
 )
 
 const pkgPath = "v.io/x/ref/services/build/buildd"
@@ -50,18 +49,18 @@
 // TODO(jsimsa): Analyze the binary files for shared library
 // dependencies and ship these back.
 func (i *builderService) Build(ctx *context.T, call build.BuilderBuildServerCall, arch build.Architecture, opsys build.OperatingSystem) ([]byte, error) {
-	vlog.VI(1).Infof("Build(%v, %v) called.", arch, opsys)
+	ctx.VI(1).Infof("Build(%v, %v) called.", arch, opsys)
 	dir, prefix := "", ""
 	dirPerm, filePerm := os.FileMode(0700), os.FileMode(0600)
 	root, err := ioutil.TempDir(dir, prefix)
 	if err != nil {
-		vlog.Errorf("TempDir(%v, %v) failed: %v", dir, prefix, err)
+		ctx.Errorf("TempDir(%v, %v) failed: %v", dir, prefix, err)
 		return nil, verror.New(verror.ErrInternal, ctx)
 	}
 	defer os.RemoveAll(root)
 	srcDir := filepath.Join(root, "go", "src")
 	if err := os.MkdirAll(srcDir, dirPerm); err != nil {
-		vlog.Errorf("MkdirAll(%v, %v) failed: %v", srcDir, dirPerm, err)
+		ctx.Errorf("MkdirAll(%v, %v) failed: %v", srcDir, dirPerm, err)
 		return nil, verror.New(verror.ErrInternal, ctx)
 	}
 	iterator := call.RecvStream()
@@ -70,16 +69,16 @@
 		filePath := filepath.Join(srcDir, filepath.FromSlash(srcFile.Name))
 		dir := filepath.Dir(filePath)
 		if err := os.MkdirAll(dir, dirPerm); err != nil {
-			vlog.Errorf("MkdirAll(%v, %v) failed: %v", dir, dirPerm, err)
+			ctx.Errorf("MkdirAll(%v, %v) failed: %v", dir, dirPerm, err)
 			return nil, verror.New(verror.ErrInternal, ctx)
 		}
 		if err := ioutil.WriteFile(filePath, srcFile.Contents, filePerm); err != nil {
-			vlog.Errorf("WriteFile(%v, %v) failed: %v", filePath, filePerm, err)
+			ctx.Errorf("WriteFile(%v, %v) failed: %v", filePath, filePerm, err)
 			return nil, verror.New(verror.ErrInternal, ctx)
 		}
 	}
 	if err := iterator.Err(); err != nil {
-		vlog.Errorf("Advance() failed: %v", err)
+		ctx.Errorf("Advance() failed: %v", err)
 		return nil, verror.New(verror.ErrInternal, ctx)
 	}
 	// NOTE: we actually want run "go install -v {srcDir}/..." here, but
@@ -98,16 +97,16 @@
 	cmd.Stdout = &output
 	cmd.Stderr = &output
 	if err := cmd.Run(); err != nil {
-		vlog.Errorf("Run(%q) failed: %v", strings.Join(cmd.Args, " "), err)
+		ctx.Errorf("Run(%q) failed: %v", strings.Join(cmd.Args, " "), err)
 		if output.Len() != 0 {
-			vlog.Errorf("%v", output.String())
+			ctx.Errorf("%v", output.String())
 		}
 		return output.Bytes(), verror.New(errBuildFailed, ctx)
 	}
 	binDir := filepath.Join(root, "go", "bin")
 	machineArch, err := host.Arch()
 	if err != nil {
-		vlog.Errorf("Arch() failed: %v", err)
+		ctx.Errorf("Arch() failed: %v", err)
 		return nil, verror.New(verror.ErrInternal, ctx)
 	}
 	if machineArch != arch.ToGoArch() || runtime.GOOS != opsys.ToGoOS() {
@@ -115,14 +114,14 @@
 	}
 	files, err := ioutil.ReadDir(binDir)
 	if err != nil && !os.IsNotExist(err) {
-		vlog.Errorf("ReadDir(%v) failed: %v", binDir, err)
+		ctx.Errorf("ReadDir(%v) failed: %v", binDir, err)
 		return nil, verror.New(verror.ErrInternal, ctx)
 	}
 	for _, file := range files {
 		binPath := filepath.Join(binDir, file.Name())
 		bytes, err := ioutil.ReadFile(binPath)
 		if err != nil {
-			vlog.Errorf("ReadFile(%v) failed: %v", binPath, err)
+			ctx.Errorf("ReadFile(%v) failed: %v", binPath, err)
 			return nil, verror.New(verror.ErrInternal, ctx)
 		}
 		result := build.File{
@@ -130,7 +129,7 @@
 			Contents: bytes,
 		}
 		if err := call.SendStream().Send(result); err != nil {
-			vlog.Errorf("Send() failed: %v", err)
+			ctx.Errorf("Send() failed: %v", err)
 			return nil, verror.New(verror.ErrInternal, ctx)
 		}
 	}
diff --git a/services/groups/internal/server/server_test.go b/services/groups/internal/server/server_test.go
index 0ea807e..11d81b1 100644
--- a/services/groups/internal/server/server_test.go
+++ b/services/groups/internal/server/server_test.go
@@ -18,7 +18,6 @@
 	"v.io/v23/security/access"
 	"v.io/v23/services/groups"
 	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/xrpc"
 	_ "v.io/x/ref/runtime/factories/generic"
 	"v.io/x/ref/services/groups/internal/server"
@@ -105,11 +104,11 @@
 	} else {
 		file, err = ioutil.TempFile("", "")
 		if err != nil {
-			vlog.Fatal("ioutil.TempFile() failed: ", err)
+			ctx.Fatal("ioutil.TempFile() failed: ", err)
 		}
 		st, err = gkv.New(file.Name())
 		if err != nil {
-			vlog.Fatal("gkv.New() failed: ", err)
+			ctx.Fatal("gkv.New() failed: ", err)
 		}
 	}
 
@@ -117,7 +116,7 @@
 
 	server, err := xrpc.NewDispatchingServer(ctx, "", m)
 	if err != nil {
-		vlog.Fatal("NewDispatchingServer() failed: ", err)
+		ctx.Fatal("NewDispatchingServer() failed: ", err)
 	}
 
 	name := server.Status().Endpoints[0].Name()
@@ -136,25 +135,25 @@
 	// Have the server principal bless the client principal as "client".
 	blessings, err := sp.Bless(cp.PublicKey(), sp.BlessingStore().Default(), "client", security.UnconstrainedUse())
 	if err != nil {
-		vlog.Fatal("sp.Bless() failed: ", err)
+		clientCtx.Fatal("sp.Bless() failed: ", err)
 	}
 	// Have the client present its "client" blessing when talking to the server.
 	if _, err := cp.BlessingStore().Set(blessings, "server"); err != nil {
-		vlog.Fatal("cp.BlessingStore().Set() failed: ", err)
+		clientCtx.Fatal("cp.BlessingStore().Set() failed: ", err)
 	}
 	// Have the client treat the server's public key as an authority on all
 	// blessings that match the pattern "server".
 	if err := cp.AddToRoots(blessings); err != nil {
-		vlog.Fatal("cp.AddToRoots() failed: ", err)
+		clientCtx.Fatal("cp.AddToRoots() failed: ", err)
 	}
 
 	clientCtx, err = v23.WithPrincipal(ctx, cp)
 	if err != nil {
-		vlog.Fatal("v23.WithPrincipal() failed: ", err)
+		clientCtx.Fatal("v23.WithPrincipal() failed: ", err)
 	}
 	serverCtx, err := v23.WithPrincipal(ctx, sp)
 	if err != nil {
-		vlog.Fatal("v23.WithPrincipal() failed: ", err)
+		clientCtx.Fatal("v23.WithPrincipal() failed: ", err)
 	}
 
 	serverName, stopServer := newServer(serverCtx)
diff --git a/services/identity/identityd/main.go b/services/identity/identityd/main.go
index b468658..6f242de 100644
--- a/services/identity/identityd/main.go
+++ b/services/identity/identityd/main.go
@@ -16,7 +16,6 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/x/lib/cmdline"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/security"
 	"v.io/x/ref/lib/v23cmd"
 	_ "v.io/x/ref/runtime/factories/static"
@@ -108,7 +107,7 @@
 		}
 	}
 
-	googleoauth, err := oauth.NewGoogleOAuth(googleConfigWeb)
+	googleoauth, err := oauth.NewGoogleOAuth(ctx, googleConfigWeb)
 	if err != nil {
 		return env.UsageErrorf("Failed to setup GoogleOAuth: %v", err)
 	}
@@ -118,7 +117,7 @@
 		return fmt.Errorf("Failed to create sql auditor from config: %v", err)
 	}
 
-	revocationManager, err := revocation.NewRevocationManager(sqlDB)
+	revocationManager, err := revocation.NewRevocationManager(ctx, sqlDB)
 	if err != nil {
 		return fmt.Errorf("Failed to start RevocationManager: %v", err)
 	}
@@ -129,7 +128,7 @@
 		auditor,
 		reader,
 		revocationManager,
-		googleOAuthBlesserParams(googleoauth, revocationManager),
+		googleOAuthBlesserParams(ctx, googleoauth, revocationManager),
 		caveats.NewBrowserCaveatSelector(assetsPrefix),
 		assetsPrefix,
 		mountPrefix)
@@ -137,19 +136,19 @@
 	return nil
 }
 
-func googleOAuthBlesserParams(oauthProvider oauth.OAuthProvider, revocationManager revocation.RevocationManager) blesser.OAuthBlesserParams {
+func googleOAuthBlesserParams(ctx *context.T, oauthProvider oauth.OAuthProvider, revocationManager revocation.RevocationManager) blesser.OAuthBlesserParams {
 	params := blesser.OAuthBlesserParams{
 		OAuthProvider:     oauthProvider,
 		BlessingDuration:  365 * 24 * time.Hour,
 		RevocationManager: revocationManager,
 	}
 	if clientID, err := getOAuthClientID(googleConfigChrome); err != nil {
-		vlog.Info(err)
+		ctx.Info(err)
 	} else {
 		params.AccessTokenClients = append(params.AccessTokenClients, oauth.AccessTokenClient{Name: "chrome", ClientID: clientID})
 	}
 	if clientID, err := getOAuthClientID(googleConfigAndroid); err != nil {
-		vlog.Info(err)
+		ctx.Info(err)
 	} else {
 		params.AccessTokenClients = append(params.AccessTokenClients, oauth.AccessTokenClient{Name: "android", ClientID: clientID})
 	}
diff --git a/services/identity/identitylib/test_identityd.go b/services/identity/identitylib/test_identityd.go
index a633bbd..054d5c5 100644
--- a/services/identity/identitylib/test_identityd.go
+++ b/services/identity/identitylib/test_identityd.go
@@ -69,7 +69,7 @@
 	}
 
 	auditor, reader := auditor.NewMockBlessingAuditor()
-	revocationManager := revocation.NewMockRevocationManager()
+	revocationManager := revocation.NewMockRevocationManager(ctx)
 	oauthProvider := oauth.NewMockOAuth("testemail@example.com")
 
 	params := blesser.OAuthBlesserParams{
diff --git a/services/identity/internal/auditor/blessing_auditor.go b/services/identity/internal/auditor/blessing_auditor.go
index 1c5b274..680d53a 100644
--- a/services/identity/internal/auditor/blessing_auditor.go
+++ b/services/identity/internal/auditor/blessing_auditor.go
@@ -10,6 +10,7 @@
 	"strings"
 	"time"
 
+	"v.io/v23/context"
 	"v.io/v23/security"
 	"v.io/v23/vom"
 	"v.io/x/ref/lib/security/audit"
@@ -18,7 +19,7 @@
 // BlessingLogReader provides the Read method to read audit logs.
 // Read returns a channel of BlessingEntrys whose extension matches the provided email.
 type BlessingLogReader interface {
-	Read(email string) <-chan BlessingEntry
+	Read(ctx *context.T, email string) <-chan BlessingEntry
 }
 
 // BlessingEntry contains important logged information about a blessed principal.
@@ -47,7 +48,7 @@
 	db database
 }
 
-func (a *blessingAuditor) Audit(entry audit.Entry) error {
+func (a *blessingAuditor) Audit(ctx *context.T, entry audit.Entry) error {
 	if entry.Method != "Bless" {
 		return nil
 	}
@@ -55,22 +56,22 @@
 	if err != nil {
 		return err
 	}
-	return a.db.Insert(dbentry)
+	return a.db.Insert(ctx, dbentry)
 }
 
 type blessingLogReader struct {
 	db database
 }
 
-func (r *blessingLogReader) Read(email string) <-chan BlessingEntry {
+func (r *blessingLogReader) Read(ctx *context.T, email string) <-chan BlessingEntry {
 	c := make(chan BlessingEntry)
-	go r.sendAuditEvents(c, email)
+	go r.sendAuditEvents(ctx, c, email)
 	return c
 }
 
-func (r *blessingLogReader) sendAuditEvents(dst chan<- BlessingEntry, email string) {
+func (r *blessingLogReader) sendAuditEvents(ctx *context.T, dst chan<- BlessingEntry, email string) {
 	defer close(dst)
-	dbch := r.db.Query(email)
+	dbch := r.db.Query(ctx, email)
 	for dbentry := range dbch {
 		dst <- newBlessingEntry(dbentry)
 	}
diff --git a/services/identity/internal/auditor/blessing_auditor_test.go b/services/identity/internal/auditor/blessing_auditor_test.go
index eb7a4a6..84919c7 100644
--- a/services/identity/internal/auditor/blessing_auditor_test.go
+++ b/services/identity/internal/auditor/blessing_auditor_test.go
@@ -12,9 +12,12 @@
 	"v.io/v23/security"
 	vsecurity "v.io/x/ref/lib/security"
 	"v.io/x/ref/lib/security/audit"
+	"v.io/x/ref/test"
 )
 
 func TestBlessingAuditor(t *testing.T) {
+	ctx, shutdown := test.V23InitWithParams(test.InitParams{})
+	defer shutdown()
 	auditor, reader := NewMockBlessingAuditor()
 
 	p, err := vsecurity.NewPrincipal()
@@ -58,14 +61,14 @@
 		for _, cav := range test.Caveats {
 			args = append(args, cav)
 		}
-		if err := auditor.Audit(audit.Entry{
+		if err := auditor.Audit(ctx, audit.Entry{
 			Method:    "Bless",
 			Arguments: args,
 			Results:   []interface{}{test.Blessings},
 		}); err != nil {
 			t.Errorf("Failed to audit Blessing %v: %v", test.Blessings, err)
 		}
-		ch := reader.Read("query")
+		ch := reader.Read(ctx, "query")
 		got := <-ch
 		if got.Email != test.Email {
 			t.Errorf("got %v, want %v", got.Email, test.Email)
diff --git a/services/identity/internal/auditor/mock_auditor.go b/services/identity/internal/auditor/mock_auditor.go
index 9473b22..65d179a 100644
--- a/services/identity/internal/auditor/mock_auditor.go
+++ b/services/identity/internal/auditor/mock_auditor.go
@@ -7,6 +7,7 @@
 import (
 	"reflect"
 
+	"v.io/v23/context"
 	"v.io/x/ref/lib/security/audit"
 )
 
@@ -19,12 +20,12 @@
 	NextEntry databaseEntry
 }
 
-func (db *mockDatabase) Insert(entry databaseEntry) error {
+func (db *mockDatabase) Insert(ctx *context.T, entry databaseEntry) error {
 	db.NextEntry = entry
 	return nil
 }
 
-func (db *mockDatabase) Query(email string) <-chan databaseEntry {
+func (db *mockDatabase) Query(ctx *context.T, email string) <-chan databaseEntry {
 	c := make(chan databaseEntry)
 	go func() {
 		var empty databaseEntry
diff --git a/services/identity/internal/auditor/sql_database.go b/services/identity/internal/auditor/sql_database.go
index c2bc071..0c85bab 100644
--- a/services/identity/internal/auditor/sql_database.go
+++ b/services/identity/internal/auditor/sql_database.go
@@ -9,12 +9,12 @@
 	"fmt"
 	"time"
 
-	"v.io/x/lib/vlog"
+	"v.io/v23/context"
 )
 
 type database interface {
-	Insert(entry databaseEntry) error
-	Query(email string) <-chan databaseEntry
+	Insert(ctx *context.T, entry databaseEntry) error
+	Query(ctx *context.T, email string) <-chan databaseEntry
 }
 
 type databaseEntry struct {
@@ -39,7 +39,10 @@
 		return nil, err
 	}
 	queryStmt, err := db.Prepare(fmt.Sprintf("SELECT Email, Caveats, Timestamp, Blessings FROM %s WHERE Email=? ORDER BY Timestamp DESC", table))
-	return sqlDatabase{insertStmt, queryStmt}, err
+	return sqlDatabase{
+		insertStmt: insertStmt,
+		queryStmt:  queryStmt,
+	}, err
 }
 
 // Table with 4 columns:
@@ -51,29 +54,29 @@
 	insertStmt, queryStmt *sql.Stmt
 }
 
-func (s sqlDatabase) Insert(entry databaseEntry) error {
+func (s sqlDatabase) Insert(ctx *context.T, entry databaseEntry) error {
 	_, err := s.insertStmt.Exec(entry.email, entry.caveats, entry.timestamp, entry.blessings)
 	return err
 }
 
-func (s sqlDatabase) Query(email string) <-chan databaseEntry {
+func (s sqlDatabase) Query(ctx *context.T, email string) <-chan databaseEntry {
 	c := make(chan databaseEntry)
-	go s.sendDatabaseEntries(email, c)
+	go s.sendDatabaseEntries(ctx, email, c)
 	return c
 }
 
-func (s sqlDatabase) sendDatabaseEntries(email string, dst chan<- databaseEntry) {
+func (s sqlDatabase) sendDatabaseEntries(ctx *context.T, email string, dst chan<- databaseEntry) {
 	defer close(dst)
 	rows, err := s.queryStmt.Query(email)
 	if err != nil {
-		vlog.Errorf("query failed %v", err)
+		ctx.Errorf("query failed %v", err)
 		dst <- databaseEntry{decodeErr: fmt.Errorf("Failed to query for all audits: %v", err)}
 		return
 	}
 	for rows.Next() {
 		var dbentry databaseEntry
 		if err = rows.Scan(&dbentry.email, &dbentry.caveats, &dbentry.timestamp, &dbentry.blessings); err != nil {
-			vlog.Errorf("scan of row failed %v", err)
+			ctx.Errorf("scan of row failed %v", err)
 			dbentry.decodeErr = fmt.Errorf("failed to read sql row, %s", err)
 		}
 		dst <- dbentry
diff --git a/services/identity/internal/auditor/sql_database_test.go b/services/identity/internal/auditor/sql_database_test.go
index c1a6e4e..56d9abb 100644
--- a/services/identity/internal/auditor/sql_database_test.go
+++ b/services/identity/internal/auditor/sql_database_test.go
@@ -5,13 +5,19 @@
 package auditor
 
 import (
-	"github.com/DATA-DOG/go-sqlmock"
 	"reflect"
 	"testing"
 	"time"
+
+	sqlmock "github.com/DATA-DOG/go-sqlmock"
+
+	_ "v.io/x/ref/runtime/factories/fake"
+	"v.io/x/ref/test"
 )
 
 func TestSQLDatabaseQuery(t *testing.T) {
+	ctx, shutdown := test.V23InitWithParams(test.InitParams{})
+	defer shutdown()
 	db, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("failed to create new mock database stub: %v", err)
@@ -33,7 +39,7 @@
 	sqlmock.ExpectExec("INSERT INTO tableName (.+) VALUES (.+)").
 		WithArgs(entry.email, entry.caveats, entry.timestamp, entry.blessings).
 		WillReturnResult(sqlmock.NewResult(0, 1)) // no insert id, 1 affected row
-	if err := d.Insert(entry); err != nil {
+	if err := d.Insert(ctx, entry); err != nil {
 		t.Errorf("failed to insert into SQLDatabase: %v", err)
 	}
 
@@ -41,7 +47,7 @@
 	sqlmock.ExpectQuery("SELECT Email, Caveats, Timestamp, Blessings FROM tableName").
 		WithArgs(entry.email).
 		WillReturnRows(sqlmock.NewRows(columns).AddRow(entry.email, entry.caveats, entry.timestamp, entry.blessings))
-	ch := d.Query(entry.email)
+	ch := d.Query(ctx, entry.email)
 	if res := <-ch; !reflect.DeepEqual(res, entry) {
 		t.Errorf("got %#v, expected %#v", res, entry)
 	}
diff --git a/services/identity/internal/identityd_test/main.go b/services/identity/internal/identityd_test/main.go
index f9cccac..a34f35f 100644
--- a/services/identity/internal/identityd_test/main.go
+++ b/services/identity/internal/identityd_test/main.go
@@ -91,7 +91,7 @@
 	}
 
 	auditor, reader := auditor.NewMockBlessingAuditor()
-	revocationManager := revocation.NewMockRevocationManager()
+	revocationManager := revocation.NewMockRevocationManager(ctx)
 	oauthProvider := oauth.NewMockOAuth(oauthEmail)
 
 	params := blesser.OAuthBlesserParams{
diff --git a/services/identity/internal/oauth/googleoauth.go b/services/identity/internal/oauth/googleoauth.go
index c8898cf..a2f20de 100644
--- a/services/identity/internal/oauth/googleoauth.go
+++ b/services/identity/internal/oauth/googleoauth.go
@@ -7,11 +7,12 @@
 import (
 	"encoding/json"
 	"fmt"
-	"golang.org/x/oauth2"
 	"net/http"
 	"os"
 
-	"v.io/x/lib/vlog"
+	"golang.org/x/oauth2"
+
+	"v.io/v23/context"
 )
 
 // googleOAuth implements the OAuthProvider interface with google oauth 2.0.
@@ -24,9 +25,11 @@
 	// (From https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken
 	// and https://developers.google.com/accounts/docs/OAuth2UserAgent#validatetoken)
 	verifyURL string
+
+	ctx *context.T
 }
 
-func NewGoogleOAuth(configFile string) (OAuthProvider, error) {
+func NewGoogleOAuth(ctx *context.T, configFile string) (OAuthProvider, error) {
 	clientID, clientSecret, err := getOAuthClientIDAndSecret(configFile)
 	if err != nil {
 		return nil, err
@@ -38,6 +41,7 @@
 		authURL:      "https://accounts.google.com/o/oauth2/auth",
 		tokenURL:     "https://accounts.google.com/o/oauth2/token",
 		verifyURL:    "https://www.googleapis.com/oauth2/v1/tokeninfo?",
+		ctx:          ctx,
 	}, nil
 }
 
@@ -142,7 +146,7 @@
 		}
 	}
 	if !audienceMatch {
-		vlog.Infof("Got access token [%+v], wanted one of client ids %v", token, accessTokenClients)
+		g.ctx.Infof("Got access token [%+v], wanted one of client ids %v", token, accessTokenClients)
 		return "", "", fmt.Errorf("token not meant for this purpose, confused deputy? https://developers.google.com/accounts/docs/OAuth2UserAgent#validatetoken")
 	}
 	// We check both "verified_email" and "email_verified" here because the token response sometimes
diff --git a/services/identity/internal/oauth/handler.go b/services/identity/internal/oauth/handler.go
index 6d339b6..deb7bf5 100644
--- a/services/identity/internal/oauth/handler.go
+++ b/services/identity/internal/oauth/handler.go
@@ -34,9 +34,9 @@
 	"strings"
 	"time"
 
+	"v.io/v23/context"
 	"v.io/v23/security"
 	"v.io/v23/vom"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/identity/internal/auditor"
 	"v.io/x/ref/services/identity/internal/caveats"
 	"v.io/x/ref/services/identity/internal/revocation"
@@ -105,54 +105,56 @@
 // NewHandler returns an http.Handler that expects to be rooted at args.Addr
 // and can be used to authenticate with args.OAuthProvider, mint a new
 // identity and bless it with the OAuthProvider email address.
-func NewHandler(args HandlerArgs) (http.Handler, error) {
-	csrfCop, err := util.NewCSRFCop()
+func NewHandler(ctx *context.T, args HandlerArgs) (http.Handler, error) {
+	csrfCop, err := util.NewCSRFCop(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("NewHandler failed to create csrfCop: %v", err)
 	}
 	return &handler{
 		args:    args,
 		csrfCop: csrfCop,
+		ctx:     ctx,
 	}, nil
 }
 
 type handler struct {
 	args    HandlerArgs
 	csrfCop *util.CSRFCop
+	ctx     *context.T
 }
 
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	switch path.Base(r.URL.Path) {
 	case ListBlessingsRoute:
-		h.listBlessings(w, r)
+		h.listBlessings(h.ctx, w, r)
 	case listBlessingsCallbackRoute:
-		h.listBlessingsCallback(w, r)
+		h.listBlessingsCallback(h.ctx, w, r)
 	case revokeRoute:
-		h.revoke(w, r)
+		h.revoke(h.ctx, w, r)
 	case SeekBlessingsRoute:
-		h.seekBlessings(w, r)
+		h.seekBlessings(h.ctx, w, r)
 	case addCaveatsRoute:
-		h.addCaveats(w, r)
+		h.addCaveats(h.ctx, w, r)
 	case sendMacaroonRoute:
-		h.sendMacaroon(w, r)
+		h.sendMacaroon(h.ctx, w, r)
 	default:
 		util.HTTPBadRequest(w, r, nil)
 	}
 }
 
-func (h *handler) listBlessings(w http.ResponseWriter, r *http.Request) {
+func (h *handler) listBlessings(ctx *context.T, w http.ResponseWriter, r *http.Request) {
 	csrf, err := h.csrfCop.NewToken(w, r, clientIDCookie, nil)
 	if err != nil {
-		vlog.Infof("Failed to create CSRF token[%v] for request %#v", err, r)
+		ctx.Infof("Failed to create CSRF token[%v] for request %#v", err, r)
 		util.HTTPServerError(w, fmt.Errorf("failed to create new token: %v", err))
 		return
 	}
 	http.Redirect(w, r, h.args.OAuthProvider.AuthURL(redirectURL(h.args.Addr, listBlessingsCallbackRoute), csrf, ReuseApproval), http.StatusFound)
 }
 
-func (h *handler) listBlessingsCallback(w http.ResponseWriter, r *http.Request) {
+func (h *handler) listBlessingsCallback(ctx *context.T, w http.ResponseWriter, r *http.Request) {
 	if err := h.csrfCop.ValidateToken(r.FormValue("state"), r, clientIDCookie, nil); err != nil {
-		vlog.Infof("Invalid CSRF token: %v in request: %#v", err, r)
+		ctx.Infof("Invalid CSRF token: %v in request: %#v", err, r)
 		util.HTTPBadRequest(w, r, fmt.Errorf("Suspected request forgery: %v", err))
 		return
 	}
@@ -184,13 +186,13 @@
 		GoogleServers:    h.args.GoogleServers,
 		DischargeServers: h.args.DischargeServers,
 	}
-	entrych := h.args.BlessingLogReader.Read(email)
+	entrych := h.args.BlessingLogReader.Read(ctx, email)
 
 	w.Header().Set("Context-Type", "text/html")
 	// This MaybeSetCookie call is needed to ensure that a cookie is created. Since the
 	// header cannot be changed once the body is written to, this needs to be called first.
 	if _, err = h.csrfCop.MaybeSetCookie(w, r, clientIDCookie); err != nil {
-		vlog.Infof("Failed to set CSRF cookie[%v] for request %#v", err, r)
+		ctx.Infof("Failed to set CSRF cookie[%v] for request %#v", err, r)
 		util.HTTPServerError(w, err)
 		return
 	}
@@ -204,7 +206,7 @@
 			}
 			if len(entry.Caveats) > 0 {
 				if tmplEntry.Caveats, err = prettyPrintCaveats(entry.Caveats); err != nil {
-					vlog.Errorf("Failed to pretty print caveats: %v", err)
+					ctx.Errorf("Failed to pretty print caveats: %v", err)
 					tmplEntry.Error = fmt.Errorf("failed to pretty print caveats: %v", err)
 				}
 			}
@@ -214,7 +216,7 @@
 				} else {
 					caveatID := base64.URLEncoding.EncodeToString([]byte(entry.RevocationCaveatID))
 					if tmplEntry.Token, err = h.csrfCop.NewToken(w, r, clientIDCookie, caveatID); err != nil {
-						vlog.Errorf("Failed to create CSRF token[%v] for request %#v", err, r)
+						ctx.Errorf("Failed to create CSRF token[%v] for request %#v", err, r)
 						tmplEntry.Error = fmt.Errorf("server error: unable to create revocation token")
 					}
 				}
@@ -223,7 +225,7 @@
 		}
 	}(tmplargs.Log)
 	if err := templates.ListBlessings.Execute(w, tmplargs); err != nil {
-		vlog.Errorf("Unable to execute audit page template: %v", err)
+		ctx.Errorf("Unable to execute audit page template: %v", err)
 		util.HTTPServerError(w, err)
 	}
 }
@@ -257,21 +259,21 @@
 	return s, nil
 }
 
-func (h *handler) revoke(w http.ResponseWriter, r *http.Request) {
+func (h *handler) revoke(ctx *context.T, w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	const (
 		success = `{"success": "true"}`
 		failure = `{"success": "false"}`
 	)
 	if h.args.RevocationManager == nil {
-		vlog.Infof("no provided revocation manager")
+		ctx.Infof("no provided revocation manager")
 		w.Write([]byte(failure))
 		return
 	}
 
 	content, err := ioutil.ReadAll(r.Body)
 	if err != nil {
-		vlog.Infof("Failed to parse request: %s", err)
+		ctx.Infof("Failed to parse request: %s", err)
 		w.Write([]byte(failure))
 		return
 	}
@@ -279,19 +281,19 @@
 		Token string
 	}
 	if err := json.Unmarshal(content, &requestParams); err != nil {
-		vlog.Infof("json.Unmarshal failed : %s", err)
+		ctx.Infof("json.Unmarshal failed : %s", err)
 		w.Write([]byte(failure))
 		return
 	}
 
 	var caveatID string
-	if caveatID, err = h.validateRevocationToken(requestParams.Token, r); err != nil {
-		vlog.Infof("failed to validate token for caveat: %s", err)
+	if caveatID, err = h.validateRevocationToken(ctx, requestParams.Token, r); err != nil {
+		ctx.Infof("failed to validate token for caveat: %s", err)
 		w.Write([]byte(failure))
 		return
 	}
 	if err := h.args.RevocationManager.Revoke(caveatID); err != nil {
-		vlog.Infof("Revocation failed: %s", err)
+		ctx.Infof("Revocation failed: %s", err)
 		w.Write([]byte(failure))
 		return
 	}
@@ -300,7 +302,7 @@
 	return
 }
 
-func (h *handler) validateRevocationToken(Token string, r *http.Request) (string, error) {
+func (h *handler) validateRevocationToken(ctx *context.T, Token string, r *http.Request) (string, error) {
 	var encCaveatID string
 	if err := h.csrfCop.ValidateToken(Token, r, clientIDCookie, &encCaveatID); err != nil {
 		return "", fmt.Errorf("invalid CSRF token: %v in request: %#v", err, r)
@@ -335,16 +337,16 @@
 	return nil, fmt.Errorf("invalid loopback url")
 }
 
-func (h *handler) seekBlessings(w http.ResponseWriter, r *http.Request) {
+func (h *handler) seekBlessings(ctx *context.T, w http.ResponseWriter, r *http.Request) {
 	redirect := r.FormValue("redirect_url")
 	if _, err := validLoopbackURL(redirect); err != nil {
-		vlog.Infof("seekBlessings failed: invalid redirect_url: %v", err)
+		ctx.Infof("seekBlessings failed: invalid redirect_url: %v", err)
 		util.HTTPBadRequest(w, r, fmt.Errorf("invalid redirect_url: %v", err))
 		return
 	}
 	pubKeyBytes, err := base64.URLEncoding.DecodeString(r.FormValue("public_key"))
 	if err != nil {
-		vlog.Infof("seekBlessings failed: invalid public_key: %v", err)
+		ctx.Infof("seekBlessings failed: invalid public_key: %v", err)
 		util.HTTPBadRequest(w, r, fmt.Errorf("invalid public_key: %v", err))
 		return
 	}
@@ -354,7 +356,7 @@
 		PublicKey:   pubKeyBytes,
 	})
 	if err != nil {
-		vlog.Infof("Failed to create CSRF token[%v] for request %#v", err, r)
+		ctx.Infof("Failed to create CSRF token[%v] for request %#v", err, r)
 		util.HTTPServerError(w, fmt.Errorf("failed to create new token: %v", err))
 		return
 	}
@@ -366,7 +368,7 @@
 	ToolPublicKey                     []byte // Marshaled public key of the principal tool.
 }
 
-func (h *handler) addCaveats(w http.ResponseWriter, r *http.Request) {
+func (h *handler) addCaveats(ctx *context.T, w http.ResponseWriter, r *http.Request) {
 	var inputMacaroon seekBlessingsMacaroon
 	if err := h.csrfCop.ValidateToken(r.FormValue("state"), r, clientIDCookie, &inputMacaroon); err != nil {
 		util.HTTPBadRequest(w, r, fmt.Errorf("Suspected request forgery: %v", err))
@@ -384,24 +386,24 @@
 		Email:           email,
 	})
 	if err != nil {
-		vlog.Infof("Failed to create caveatForm token[%v] for request %#v", err, r)
+		ctx.Infof("Failed to create caveatForm token[%v] for request %#v", err, r)
 		util.HTTPServerError(w, fmt.Errorf("failed to create new token: %v", err))
 		return
 	}
 	localBlessings := security.DefaultBlessingPatterns(h.args.Principal)
 	if len(localBlessings) == 0 {
-		vlog.Infof("server principal has no blessings: %v", h.args.Principal)
+		ctx.Infof("server principal has no blessings: %v", h.args.Principal)
 		util.HTTPServerError(w, fmt.Errorf("failed to get server blessings"))
 		return
 	}
 	fullBlessingName := strings.Join([]string{string(localBlessings[0]), email}, security.ChainSeparator)
 	if err := h.args.CaveatSelector.Render(fullBlessingName, outputMacaroon, redirectURL(h.args.Addr, sendMacaroonRoute), w, r); err != nil {
-		vlog.Errorf("Unable to invoke render caveat selector: %v", err)
+		ctx.Errorf("Unable to invoke render caveat selector: %v", err)
 		util.HTTPServerError(w, err)
 	}
 }
 
-func (h *handler) sendMacaroon(w http.ResponseWriter, r *http.Request) {
+func (h *handler) sendMacaroon(ctx *context.T, w http.ResponseWriter, r *http.Request) {
 	var inputMacaroon addCaveatsMacaroon
 	caveatInfos, macaroonString, blessingExtension, err := h.args.CaveatSelector.ParseSelections(r)
 	cancelled := err == caveats.ErrSeekblessingsCancelled
@@ -421,11 +423,11 @@
 	}
 	// Now that we have a valid tool redirect url, we can send the errors to the tool.
 	if cancelled {
-		h.sendErrorToTool(w, r, inputMacaroon.ToolState, baseURL, caveats.ErrSeekblessingsCancelled)
+		h.sendErrorToTool(ctx, w, r, inputMacaroon.ToolState, baseURL, caveats.ErrSeekblessingsCancelled)
 	}
-	caveats, err := h.caveats(caveatInfos)
+	caveats, err := h.caveats(ctx, caveatInfos)
 	if err != nil {
-		h.sendErrorToTool(w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("failed to create caveats: %v", err))
+		h.sendErrorToTool(ctx, w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("failed to create caveats: %v", err))
 		return
 	}
 	parts := []string{inputMacaroon.Email}
@@ -433,7 +435,7 @@
 		parts = append(parts, blessingExtension)
 	}
 	if len(caveats) == 0 {
-		h.sendErrorToTool(w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("server disallows attempts to bless with no caveats"))
+		h.sendErrorToTool(ctx, w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("server disallows attempts to bless with no caveats"))
 		return
 	}
 	m := BlessingMacaroon{
@@ -444,12 +446,12 @@
 	}
 	macBytes, err := vom.Encode(m)
 	if err != nil {
-		h.sendErrorToTool(w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("failed to encode BlessingsMacaroon: %v", err))
+		h.sendErrorToTool(ctx, w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("failed to encode BlessingsMacaroon: %v", err))
 		return
 	}
 	marshalKey, err := h.args.Principal.PublicKey().MarshalBinary()
 	if err != nil {
-		h.sendErrorToTool(w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("failed to marshal public key: %v", err))
+		h.sendErrorToTool(ctx, w, r, inputMacaroon.ToolState, baseURL, fmt.Errorf("failed to marshal public key: %v", err))
 		return
 	}
 	encKey := base64.URLEncoding.EncodeToString(marshalKey)
@@ -462,7 +464,7 @@
 	http.Redirect(w, r, baseURL.String(), http.StatusFound)
 }
 
-func (h *handler) sendErrorToTool(w http.ResponseWriter, r *http.Request, toolState string, baseURL *url.URL, err error) {
+func (h *handler) sendErrorToTool(ctx *context.T, w http.ResponseWriter, r *http.Request, toolState string, baseURL *url.URL, err error) {
 	errEnc := base64.URLEncoding.EncodeToString([]byte(err.Error()))
 	params := url.Values{}
 	params.Add("error", errEnc)
@@ -471,7 +473,7 @@
 	http.Redirect(w, r, baseURL.String(), http.StatusFound)
 }
 
-func (h *handler) caveats(caveatInfos []caveats.CaveatInfo) (cavs []security.Caveat, err error) {
+func (h *handler) caveats(ctx *context.T, caveatInfos []caveats.CaveatInfo) (cavs []security.Caveat, err error) {
 	caveatFactories := caveats.NewCaveatFactory()
 	for _, caveatInfo := range caveatInfos {
 		if caveatInfo.Type == "Revocation" {
diff --git a/services/identity/internal/revocation/mock_revocation_manager.go b/services/identity/internal/revocation/mock_revocation_manager.go
index 68095a4..959443d 100644
--- a/services/identity/internal/revocation/mock_revocation_manager.go
+++ b/services/identity/internal/revocation/mock_revocation_manager.go
@@ -6,11 +6,13 @@
 
 import (
 	"time"
+
+	"v.io/v23/context"
 )
 
-func NewMockRevocationManager() RevocationManager {
+func NewMockRevocationManager(ctx *context.T) RevocationManager {
 	revocationDB = &mockDatabase{make(map[string][]byte), make(map[string]*time.Time)}
-	return &revocationManager{}
+	return &revocationManager{ctx}
 }
 
 type mockDatabase struct {
diff --git a/services/identity/internal/revocation/revocation_manager.go b/services/identity/internal/revocation/revocation_manager.go
index 47124ae..9581fb4 100644
--- a/services/identity/internal/revocation/revocation_manager.go
+++ b/services/identity/internal/revocation/revocation_manager.go
@@ -14,7 +14,6 @@
 
 	"v.io/v23/context"
 	"v.io/v23/security"
-	"v.io/x/lib/vlog"
 )
 
 // RevocationManager persists information for revocation caveats to provided discharges and allow for future revocations.
@@ -25,12 +24,12 @@
 }
 
 // revocationManager persists information for revocation caveats to provided discharges and allow for future revocations.
-type revocationManager struct{}
+type revocationManager struct{ ctx *context.T }
 
 // NewRevocationManager returns a RevocationManager that persists information about
 // revocationCaveats in a SQL database and allows for revocation and caveat creation.
 // This function can only be called once because of the use of global variables.
-func NewRevocationManager(sqlDB *sql.DB) (RevocationManager, error) {
+func NewRevocationManager(ctx *context.T, sqlDB *sql.DB) (RevocationManager, error) {
 	revocationLock.Lock()
 	defer revocationLock.Unlock()
 	if revocationDB != nil {
@@ -41,7 +40,7 @@
 	if err != nil {
 		return nil, err
 	}
-	return &revocationManager{}, nil
+	return &revocationManager{ctx: ctx}, nil
 }
 
 var revocationDB database
@@ -63,10 +62,10 @@
 	if err != nil {
 		return empty, err
 	}
-	vlog.Infof("revocationDB.InsertCaveat(%s,%v) called", cav.ThirdPartyDetails().ID(), revocation)
+	r.ctx.Infof("revocationDB.InsertCaveat(%s,%v) called", cav.ThirdPartyDetails().ID(), revocation)
 	if err = revocationDB.InsertCaveat(cav.ThirdPartyDetails().ID(), revocation[:]); err != nil {
 		// TODO(suharshs): Remove this log.
-		vlog.Infof("revocationDB.InsertCaveat(%s,%v) failed with %v", cav.ThirdPartyDetails().ID(), revocation, err)
+		r.ctx.Infof("revocationDB.InsertCaveat(%s,%v) failed with %v", cav.ThirdPartyDetails().ID(), revocation, err)
 		return empty, err
 	}
 	return cav, nil
diff --git a/services/identity/internal/revocation/revocation_test.go b/services/identity/internal/revocation/revocation_test.go
index 81ceb88..34ad488 100644
--- a/services/identity/internal/revocation/revocation_test.go
+++ b/services/identity/internal/revocation/revocation_test.go
@@ -27,7 +27,7 @@
 		t.Fatalf("r.NewServer: %s", err)
 	}
 	name := dischargerServer.Status().Endpoints[0].Name()
-	return v23.GetPrincipal(ctx).PublicKey(), name, NewMockRevocationManager()
+	return v23.GetPrincipal(ctx).PublicKey(), name, NewMockRevocationManager(ctx)
 }
 
 func TestDischargeRevokeDischargeRevokeDischarge(t *testing.T) {
diff --git a/services/identity/internal/server/identityd.go b/services/identity/internal/server/identityd.go
index 4294c71..089efce 100644
--- a/services/identity/internal/server/identityd.go
+++ b/services/identity/internal/server/identityd.go
@@ -23,7 +23,6 @@
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/security/audit"
 	"v.io/x/ref/lib/signals"
 	"v.io/x/ref/services/discharger"
@@ -105,16 +104,15 @@
 }
 
 func (s *IdentityServer) Serve(ctx *context.T, listenSpec *rpc.ListenSpec, externalHttpAddr, httpAddr, tlsConfig string) {
-	ctx, err := v23.WithPrincipal(ctx, audit.NewPrincipal(
-		v23.GetPrincipal(ctx), s.auditor))
+	ctx, err := v23.WithPrincipal(ctx, audit.NewPrincipal(ctx, s.auditor))
 	if err != nil {
-		vlog.Panic(err)
+		ctx.Panic(err)
 	}
 	httphost, httpport, err := net.SplitHostPort(httpAddr)
 	if err != nil || httpport == "0" {
 		httpportNum, err := findUnusedPort()
 		if err != nil {
-			vlog.Panic(err)
+			ctx.Panic(err)
 		}
 		httpAddr = net.JoinHostPort(httphost, strconv.Itoa(httpportNum))
 	}
@@ -125,7 +123,7 @@
 	}
 	<-signals.ShutdownOnSignals(ctx)
 	if err := rpcServer.Stop(); err != nil {
-		vlog.Errorf("Failed to stop rpc server: %v", err)
+		ctx.Errorf("Failed to stop rpc server: %v", err)
 	}
 }
 
@@ -138,12 +136,12 @@
 
 	macaroonKey := make([]byte, 32)
 	if _, err := rand.Read(macaroonKey); err != nil {
-		vlog.Fatalf("macaroonKey generation failed: %v", err)
+		ctx.Fatalf("macaroonKey generation failed: %v", err)
 	}
 
 	rpcServer, published, err := s.setupServices(ctx, listenSpec, macaroonKey)
 	if err != nil {
-		vlog.Fatalf("Failed to setup vanadium services for blessing: %v", err)
+		ctx.Fatalf("Failed to setup vanadium services for blessing: %v", err)
 	}
 
 	externalHttpAddr = httpAddress(externalHttpAddr, httpAddr)
@@ -172,9 +170,9 @@
 	if !reflect.DeepEqual(s.oauthBlesserParams, emptyParams) {
 		args.GoogleServers = appendSuffixTo(published, oauthBlesserService)
 	}
-	h, err := oauth.NewHandler(args)
+	h, err := oauth.NewHandler(ctx, args)
 	if err != nil {
-		vlog.Fatalf("Failed to create HTTP handler for oauth authentication: %v", err)
+		ctx.Fatalf("Failed to create HTTP handler for oauth authentication: %v", err)
 	}
 	http.Handle(n, h)
 
@@ -193,11 +191,11 @@
 			AssetsPrefix:       s.assetsPrefix,
 		}
 		if err := templates.Home.Execute(w, tmplArgs); err != nil {
-			vlog.Info("Failed to render template:", err)
+			ctx.Info("Failed to render template:", err)
 		}
 	})
-	vlog.Infof("Running HTTP server at: %v", externalHttpAddr)
-	go runHTTPSServer(httpAddr, tlsConfig)
+	ctx.Infof("Running HTTP server at: %v", externalHttpAddr)
+	go runHTTPSServer(ctx, httpAddr, tlsConfig)
 	return rpcServer, published, externalHttpAddr
 }
 
@@ -234,7 +232,7 @@
 	if err := server.ServeDispatcher(objectAddr, dispatcher); err != nil {
 		return nil, nil, fmt.Errorf("failed to start Vanadium services: %v", err)
 	}
-	vlog.Infof("Blessing and discharger services will be published at %v", rootedObjectAddr)
+	ctx.Infof("Blessing and discharger services will be published at %v", rootedObjectAddr)
 	return server, []string{rootedObjectAddr}, nil
 }
 
@@ -269,17 +267,17 @@
 	return inputParams
 }
 
-func runHTTPSServer(addr, tlsConfig string) {
+func runHTTPSServer(ctx *context.T, addr, tlsConfig string) {
 	if len(tlsConfig) == 0 {
-		vlog.Fatal("Please set the --tls-config flag")
+		ctx.Fatal("Please set the --tls-config flag")
 	}
 	paths := strings.Split(tlsConfig, ",")
 	if len(paths) != 2 {
-		vlog.Fatalf("Could not parse --tls-config. Must have exactly two components, separated by a comma")
+		ctx.Fatalf("Could not parse --tls-config. Must have exactly two components, separated by a comma")
 	}
-	vlog.Infof("Starting HTTP server with TLS using certificate [%s] and private key [%s] at https://%s", paths[0], paths[1], addr)
+	ctx.Infof("Starting HTTP server with TLS using certificate [%s] and private key [%s] at https://%s", paths[0], paths[1], addr)
 	if err := http.ListenAndServeTLS(addr, paths[0], paths[1], nil); err != nil {
-		vlog.Fatalf("http.ListenAndServeTLS failed: %v", err)
+		ctx.Fatalf("http.ListenAndServeTLS failed: %v", err)
 	}
 }
 
diff --git a/services/identity/internal/util/csrf.go b/services/identity/internal/util/csrf.go
index 59d6166..6409ba8 100644
--- a/services/identity/internal/util/csrf.go
+++ b/services/identity/internal/util/csrf.go
@@ -13,8 +13,8 @@
 	"net/http"
 	"time"
 
+	"v.io/v23/context"
 	"v.io/v23/vom"
-	"v.io/x/lib/vlog"
 )
 
 const (
@@ -26,6 +26,7 @@
 // cross-site-request-forgery prevention (also called XSRF).
 type CSRFCop struct {
 	key []byte
+	ctx *context.T
 }
 
 func (c *CSRFCop) keyForCookie(cookie []byte) []byte {
@@ -34,12 +35,12 @@
 	return hm.Sum(nil)
 }
 
-func NewCSRFCop() (*CSRFCop, error) {
+func NewCSRFCop(ctx *context.T) (*CSRFCop, error) {
 	key := make([]byte, keyLength)
 	if _, err := rand.Read(key); err != nil {
 		return nil, fmt.Errorf("newCSRFCop failed: %v", err)
 	}
-	return &CSRFCop{key}, nil
+	return &CSRFCop{key: key, ctx: ctx}, nil
 }
 
 // NewToken creates an anti-cross-site-request-forgery, aka CSRF aka XSRF token
@@ -84,20 +85,20 @@
 	return nil
 }
 
-func (*CSRFCop) MaybeSetCookie(w http.ResponseWriter, req *http.Request, cookieName string) ([]byte, error) {
+func (c *CSRFCop) MaybeSetCookie(w http.ResponseWriter, req *http.Request, cookieName string) ([]byte, error) {
 	cookie, err := req.Cookie(cookieName)
 	switch err {
 	case nil:
 		if v, err := decodeCookieValue(cookie.Value); err == nil {
 			return v, nil
 		}
-		vlog.Infof("Invalid cookie: %#v, err: %v. Regenerating one.", cookie, err)
+		c.ctx.Infof("Invalid cookie: %#v, err: %v. Regenerating one.", cookie, err)
 	case http.ErrNoCookie:
 		// Intentionally blank: Cookie will be generated below.
 	default:
-		vlog.Infof("Error decoding cookie %q in request: %v. Regenerating one.", cookieName, err)
+		c.ctx.Infof("Error decoding cookie %q in request: %v. Regenerating one.", cookieName, err)
 	}
-	cookie, v := newCookie(cookieName)
+	cookie, v := newCookie(c.ctx, cookieName)
 	if cookie == nil || v == nil {
 		return nil, fmt.Errorf("failed to create cookie")
 	}
@@ -108,10 +109,10 @@
 	return v, nil
 }
 
-func newCookie(cookieName string) (*http.Cookie, []byte) {
+func newCookie(ctx *context.T, cookieName string) (*http.Cookie, []byte) {
 	b := make([]byte, cookieLen)
 	if _, err := rand.Read(b); err != nil {
-		vlog.Errorf("newCookie failed: %v", err)
+		ctx.Errorf("newCookie failed: %v", err)
 		return nil, nil
 	}
 	return &http.Cookie{
diff --git a/services/identity/internal/util/csrf_test.go b/services/identity/internal/util/csrf_test.go
index 3c3eed7..8e4eefa 100644
--- a/services/identity/internal/util/csrf_test.go
+++ b/services/identity/internal/util/csrf_test.go
@@ -10,6 +10,9 @@
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"v.io/v23/context"
+	"v.io/x/ref/internal/logger"
 )
 
 const (
@@ -18,8 +21,10 @@
 )
 
 func TestCSRFTokenWithoutCookie(t *testing.T) {
+	ctx, _ := context.RootContext()
+	ctx = context.WithLogger(ctx, logger.Global())
 	r := newRequest()
-	c, err := NewCSRFCop()
+	c, err := NewCSRFCop(ctx)
 	if err != nil {
 		t.Fatalf("NewCSRFCop failed: %v", err)
 	}
@@ -59,8 +64,10 @@
 }
 
 func TestCSRFTokenWithCookie(t *testing.T) {
+	ctx, _ := context.RootContext()
+	ctx = context.WithLogger(ctx, logger.Global())
 	r := newRequest()
-	c, err := NewCSRFCop()
+	c, err := NewCSRFCop(ctx)
 	if err != nil {
 		t.Fatalf("NewCSRFCop failed: %v", err)
 	}
@@ -88,8 +95,10 @@
 }
 
 func TestCSRFTokenWithData(t *testing.T) {
+	ctx, _ := context.RootContext()
+	ctx = context.WithLogger(ctx, logger.Global())
 	r := newRequest()
-	c, err := NewCSRFCop()
+	c, err := NewCSRFCop(ctx)
 	if err != nil {
 		t.Fatalf("NewCSRFCop failed: %v", err)
 	}
diff --git a/services/identity/internal/util/write.go b/services/identity/internal/util/write.go
index 3e6833e..5eefb0c 100644
--- a/services/identity/internal/util/write.go
+++ b/services/identity/internal/util/write.go
@@ -9,7 +9,7 @@
 	"html/template"
 	"net/http"
 
-	"v.io/x/lib/vlog"
+	"v.io/x/ref/internal/logger"
 )
 
 // HTTPBadRequest sends an HTTP 400 error on 'w' and renders a pretty page.
@@ -17,7 +17,7 @@
 func HTTPBadRequest(w http.ResponseWriter, req *http.Request, err error) {
 	w.WriteHeader(http.StatusBadRequest)
 	if e := tmplBadRequest.Execute(w, badRequestData{Request: requestString(req), Error: err}); e != nil {
-		vlog.Errorf("Failed to execute Bad Request Template: %v", e)
+		logger.Global().Errorf("Failed to execute Bad Request Template: %v", e)
 	}
 }
 
@@ -26,7 +26,7 @@
 func HTTPServerError(w http.ResponseWriter, err error) {
 	w.WriteHeader(http.StatusInternalServerError)
 	if e := tmplServerError.Execute(w, err); e != nil {
-		vlog.Errorf("Failed to execute Server Error template: %v", e)
+		logger.Global().Errorf("Failed to execute Server Error template: %v", e)
 	}
 }
 
diff --git a/services/mounttable/mounttablelib/servers.go b/services/mounttable/mounttablelib/servers.go
index 9b84375..2d919d1 100644
--- a/services/mounttable/mounttablelib/servers.go
+++ b/services/mounttable/mounttablelib/servers.go
@@ -12,8 +12,6 @@
 	"v.io/v23/naming"
 	"v.io/v23/options"
 	"v.io/v23/rpc"
-
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/lib/xrpc"
 )
 
@@ -27,7 +25,7 @@
 
 	mt, err := NewMountTableDispatcher(ctx, permsFile, persistDir, debugPrefix)
 	if err != nil {
-		vlog.Errorf("NewMountTable failed: %v", err)
+		ctx.Errorf("NewMountTable failed: %v", err)
 		return "", nil, err
 	}
 	ctx = v23.WithListenSpec(ctx, listenSpec)
diff --git a/services/wspr/browsprd/main_nacl.go b/services/wspr/browsprd/main_nacl.go
index 4d07423..7e0b2bd 100644
--- a/services/wspr/browsprd/main_nacl.go
+++ b/services/wspr/browsprd/main_nacl.go
@@ -15,9 +15,11 @@
 	"runtime/ppapi"
 
 	"v.io/v23"
+	"v.io/v23/logging"
 	"v.io/v23/security"
 	"v.io/v23/vdl"
 	"v.io/x/lib/vlog"
+	"v.io/x/ref/internal/logger"
 	vsecurity "v.io/x/ref/lib/security"
 	_ "v.io/x/ref/runtime/factories/chrome"
 	"v.io/x/ref/runtime/internal/lib/websocket"
@@ -39,13 +41,14 @@
 	fs      ppapi.FileSystem
 	browspr *browspr.Browspr
 	channel *channel_nacl.Channel
+	logger  logging.Logger
 }
 
 var _ ppapi.InstanceHandlers = (*browsprInstance)(nil)
 
 func newBrowsprInstance(inst ppapi.Instance) ppapi.InstanceHandlers {
 	runtime.GOMAXPROCS(4)
-	browsprInst := &browsprInstance{Instance: inst}
+	browsprInst := &browsprInstance{Instance: inst, logger: logger.Global()}
 	browsprInst.initFileSystem()
 
 	// Give the websocket interface the ppapi instance.
@@ -80,15 +83,15 @@
 const browsprDir = "/browspr/data"
 
 func (inst *browsprInstance) loadKeyFromStorage(browsprKeyFile string) (*ecdsa.PrivateKey, error) {
-	vlog.VI(1).Infof("Attempting to read key from file %v", browsprKeyFile)
+	inst.logger.VI(1).Infof("Attempting to read key from file %v", browsprKeyFile)
 
 	rFile, err := inst.fs.Open(browsprKeyFile)
 	if err != nil {
-		vlog.VI(1).Infof("Key not found in file %v", browsprKeyFile)
+		inst.logger.VI(1).Infof("Key not found in file %v", browsprKeyFile)
 		return nil, err
 	}
 
-	vlog.VI(1).Infof("Attempting to load cached browspr ecdsaPrivateKey in file %v", browsprKeyFile)
+	inst.logger.VI(1).Infof("Attempting to load cached browspr ecdsaPrivateKey in file %v", browsprKeyFile)
 	defer rFile.Release()
 	key, err := vsecurity.LoadPEMKey(rFile, nil)
 	if err != nil {
@@ -107,10 +110,10 @@
 	if ecdsaKey, err := inst.loadKeyFromStorage(browsprKeyFile); err == nil {
 		return ecdsaKey, nil
 	} else {
-		vlog.VI(1).Infof("inst.loadKeyFromStorage(%v) failed: %v", browsprKeyFile, err)
+		inst.logger.VI(1).Infof("inst.loadKeyFromStorage(%v) failed: %v", browsprKeyFile, err)
 	}
 
-	vlog.VI(1).Infof("Generating new browspr ecdsaPrivateKey")
+	inst.logger.VI(1).Infof("Generating new browspr ecdsaPrivateKey")
 
 	// Generate new keys and store them.
 	var ecdsaKey *ecdsa.PrivateKey
@@ -163,7 +166,7 @@
 
 	principal, err := inst.newPrincipal(ecdsaKey, blessingRootsData, blessingRootsSig, blessingStoreData, blessingStoreSig)
 	if err != nil {
-		vlog.VI(1).Infof("inst.newPrincipal(%v, %v, %v, %v, %v) failed: %v", ecdsaKey, blessingRootsData, blessingRootsSig, blessingStoreData, blessingStoreSig)
+		inst.logger.VI(1).Infof("inst.newPrincipal(%v, %v, %v, %v, %v) failed: %v", ecdsaKey, blessingRootsData, blessingRootsSig, blessingStoreData, blessingStoreSig)
 
 		// Delete the files and try again.
 		for _, file := range []string{blessingRootsData, blessingRootsSig, blessingStoreData, blessingStoreSig} {
@@ -184,7 +187,7 @@
 }
 
 func (inst *browsprInstance) HandleStartMessage(val *vdl.Value) (*vdl.Value, error) {
-	vlog.VI(1).Info("Starting Browspr")
+	inst.logger.VI(1).Info("Starting Browspr")
 	var msg browspr.StartMessage
 	if err := vdl.Convert(&msg, val); err != nil {
 		return nil, fmt.Errorf("HandleStartMessage did not receive StartMessage, received: %v, %v", val, err)
@@ -209,10 +212,10 @@
 			return nil, fmt.Errorf("invalid IdentitydBlessingRoot: Names is empty")
 		}
 
-		vlog.VI(1).Infof("Using blessing roots for identity with key %v and names %v", msg.IdentitydBlessingRoot.PublicKey, msg.IdentitydBlessingRoot.Names)
+		inst.logger.VI(1).Infof("Using blessing roots for identity with key %v and names %v", msg.IdentitydBlessingRoot.PublicKey, msg.IdentitydBlessingRoot.Names)
 		key, err := decodeAndUnmarshalPublicKey(msg.IdentitydBlessingRoot.PublicKey)
 		if err != nil {
-			vlog.Fatalf("decodeAndUnmarshalPublicKey(%v) failed: %v", msg.IdentitydBlessingRoot.PublicKey, err)
+			inst.logger.Fatalf("decodeAndUnmarshalPublicKey(%v) failed: %v", msg.IdentitydBlessingRoot.PublicKey, err)
 		}
 
 		for _, name := range msg.IdentitydBlessingRoot.Names {
@@ -227,7 +230,7 @@
 			}
 		}
 	} else {
-		vlog.VI(1).Infof("IdentitydBlessingRoot.PublicKey is empty.  Will allow browspr blessing to be shareable with all principals.")
+		inst.logger.VI(1).Infof("IdentitydBlessingRoot.PublicKey is empty.  Will allow browspr blessing to be shareable with all principals.")
 		// Set our blessing as shareable with all peers.
 		if _, err := principal.BlessingStore().Set(blessing, security.AllPrincipals); err != nil {
 			return nil, fmt.Errorf("principal.BlessingStore().Set(%v, %v) failed: %v", blessing, security.AllPrincipals, err)
@@ -243,8 +246,11 @@
 		return nil, err
 	}
 
+	// TODO(cnicolaou): provide a means of configuring logging that
+	// doesn't depend on vlog - e.g. ConfigureFromArgs(args []string) to
+	// pair with ConfigureFromFlags(). See v.io/i/556
 	// Configure logger with level and module from start message.
-	vlog.VI(1).Infof("Configuring vlog with v=%v, modulesSpec=%v", msg.LogLevel, msg.LogModule)
+	inst.logger.VI(1).Infof("Configuring vlog with v=%v, modulesSpec=%v", msg.LogLevel, msg.LogModule)
 	moduleSpec := vlog.ModuleSpec{}
 	moduleSpec.Set(msg.LogModule)
 	if err := vlog.Log.Configure(vlog.OverridePriorConfiguration(true), vlog.Level(msg.LogLevel), moduleSpec); err != nil {
@@ -259,7 +265,7 @@
 	listenSpec := v23.GetListenSpec(ctx)
 	listenSpec.Proxy = msg.Proxy
 
-	vlog.VI(1).Infof("Starting browspr with config: proxy=%q mounttable=%q identityd=%q identitydBlessingRoot=%q ", msg.Proxy, msg.NamespaceRoot, msg.Identityd, msg.IdentitydBlessingRoot)
+	inst.logger.VI(1).Infof("Starting browspr with config: proxy=%q mounttable=%q identityd=%q identitydBlessingRoot=%q ", msg.Proxy, msg.NamespaceRoot, msg.Identityd, msg.IdentitydBlessingRoot)
 	inst.browspr = browspr.NewBrowspr(ctx,
 		inst.BrowsprOutgoingPostMessage,
 		&listenSpec,
@@ -305,7 +311,7 @@
 		return fmt.Errorf("Invalid message: %v", err)
 	}
 
-	vlog.VI(1).Infof("Calling browspr's HandleMessage: instanceId %d origin %s message %s", instanceId, origin, msg)
+	inst.logger.VI(1).Infof("Calling browspr's HandleMessage: instanceId %d origin %s message %s", instanceId, origin, msg)
 	if err := inst.browspr.HandleMessage(instanceId, origin, msg); err != nil {
 		return fmt.Errorf("Error while handling message in browspr: %v", err)
 	}
@@ -329,23 +335,23 @@
 // HandleBrowsprRpc handles two-way rpc messages of the type "browsprRpc"
 // sending them to the channel's handler.
 func (inst *browsprInstance) HandleBrowsprRpc(instanceId int32, origin string, message ppapi.Var) error {
-	vlog.VI(1).Infof("Got to HandleBrowsprRpc: instanceId: %d origin %s", instanceId, origin)
+	inst.logger.VI(1).Infof("Got to HandleBrowsprRpc: instanceId: %d origin %s", instanceId, origin)
 	inst.channel.HandleMessage(message)
 	return nil
 }
 
 // handleGoError handles error returned by go code.
 func (inst *browsprInstance) handleGoError(err error) {
-	vlog.VI(2).Info(err)
+	inst.logger.VI(2).Info(err)
 	inst.LogString(ppapi.PP_LOGLEVEL_ERROR, fmt.Sprintf("Error in go code: %v", err.Error()))
-	vlog.Error(err)
+	inst.logger.Error(err)
 }
 
 // HandleMessage receives messages from Javascript and uses them to perform actions.
 // A message is of the form {"type": "typeName", "body": { stuff here }},
 // where the body is passed to the message handler.
 func (inst *browsprInstance) HandleMessage(message ppapi.Var) {
-	vlog.VI(2).Infof("Got to HandleMessage")
+	inst.logger.VI(2).Infof("Got to HandleMessage")
 	instanceId, err := message.LookupIntValuedKey("instanceId")
 	if err != nil {
 		inst.handleGoError(err)
@@ -383,38 +389,38 @@
 }
 
 func (inst browsprInstance) DidCreate(args map[string]string) bool {
-	vlog.VI(2).Infof("Got to DidCreate")
+	inst.logger.VI(2).Infof("Got to DidCreate")
 	return true
 }
 
-func (*browsprInstance) DidDestroy() {
-	vlog.VI(2).Infof("Got to DidDestroy()")
+func (inst *browsprInstance) DidDestroy() {
+	inst.logger.VI(2).Infof("Got to DidDestroy()")
 }
 
-func (*browsprInstance) DidChangeView(view ppapi.View) {
-	vlog.VI(2).Infof("Got to DidChangeView(%v)", view)
+func (inst *browsprInstance) DidChangeView(view ppapi.View) {
+	inst.logger.VI(2).Infof("Got to DidChangeView(%v)", view)
 }
 
-func (*browsprInstance) DidChangeFocus(has_focus bool) {
-	vlog.VI(2).Infof("Got to DidChangeFocus(%v)", has_focus)
+func (inst *browsprInstance) DidChangeFocus(has_focus bool) {
+	inst.logger.VI(2).Infof("Got to DidChangeFocus(%v)", has_focus)
 }
 
-func (*browsprInstance) HandleDocumentLoad(url_loader ppapi.Resource) bool {
-	vlog.VI(2).Infof("Got to HandleDocumentLoad(%v)", url_loader)
+func (inst *browsprInstance) HandleDocumentLoad(url_loader ppapi.Resource) bool {
+	inst.logger.VI(2).Infof("Got to HandleDocumentLoad(%v)", url_loader)
 	return true
 }
 
-func (*browsprInstance) HandleInputEvent(event ppapi.InputEvent) bool {
-	vlog.VI(2).Infof("Got to HandleInputEvent(%v)", event)
+func (inst *browsprInstance) HandleInputEvent(event ppapi.InputEvent) bool {
+	inst.logger.VI(2).Infof("Got to HandleInputEvent(%v)", event)
 	return true
 }
 
-func (*browsprInstance) Graphics3DContextLost() {
-	vlog.VI(2).Infof("Got to Graphics3DContextLost()")
+func (inst *browsprInstance) Graphics3DContextLost() {
+	inst.logger.VI(2).Infof("Got to Graphics3DContextLost()")
 }
 
-func (*browsprInstance) MouseLockLost() {
-	vlog.VI(2).Infof("Got to MouseLockLost()")
+func (inst *browsprInstance) MouseLockLost() {
+	inst.logger.VI(2).Infof("Got to MouseLockLost()")
 }
 
 func varToMessage(v ppapi.Var) (app.Message, error) {
diff --git a/services/wspr/internal/account/account.go b/services/wspr/internal/account/account.go
index 0289534..7d977d6 100644
--- a/services/wspr/internal/account/account.go
+++ b/services/wspr/internal/account/account.go
@@ -14,7 +14,6 @@
 	"v.io/v23/context"
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/wspr/internal/principal"
 )
 
@@ -82,7 +81,7 @@
 	return am.accounts
 }
 
-func (am *AccountManager) AssociateAccount(origin, account string, cavs []Caveat) error {
+func (am *AccountManager) AssociateAccount(ctx *context.T, origin, account string, cavs []Caveat) error {
 	caveats, expirations, err := constructCaveats(cavs)
 	if err != nil {
 		return fmt.Errorf("failed to construct caveats: %v", err)
@@ -91,7 +90,7 @@
 	if err := am.principalManager.AddOrigin(origin, account, caveats, expirations); err != nil {
 		return fmt.Errorf("failed to associate account: %v", err)
 	}
-	vlog.VI(1).Infof("Associated origin %v with account %v and cavs %v", origin, account, caveats)
+	ctx.VI(1).Infof("Associated origin %v with account %v and cavs %v", origin, account, caveats)
 	return nil
 }
 
diff --git a/services/wspr/internal/app/app.go b/services/wspr/internal/app/app.go
index 0d72c34..a504463 100644
--- a/services/wspr/internal/app/app.go
+++ b/services/wspr/internal/app/app.go
@@ -27,7 +27,6 @@
 	"v.io/v23/verror"
 	"v.io/v23/vom"
 	"v.io/v23/vtrace"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/wspr/internal/lib"
 	"v.io/x/ref/services/wspr/internal/namespace"
 	"v.io/x/ref/services/wspr/internal/principal"
@@ -317,8 +316,8 @@
 }
 
 // Cleanup cleans up any outstanding rpcs.
-func (c *Controller) Cleanup() {
-	vlog.VI(0).Info("Cleaning up controller")
+func (c *Controller) Cleanup(ctx *context.T) {
+	ctx.VI(0).Info("Cleaning up controller")
 	c.Lock()
 
 	for _, request := range c.outstandingRequests {
@@ -359,11 +358,11 @@
 
 // SendOnStream writes data on id's stream.  The actual network write will be
 // done asynchronously.  If there is an error, it will be sent to w.
-func (c *Controller) SendOnStream(id int32, data string, w lib.ClientWriter) {
+func (c *Controller) SendOnStream(ctx *context.T, id int32, data string, w lib.ClientWriter) {
 	c.Lock()
 	request := c.outstandingRequests[id]
 	if request == nil || request.stream == nil {
-		vlog.Errorf("unknown stream: %d", id)
+		ctx.Errorf("unknown stream: %d", id)
 		c.Unlock()
 		return
 	}
@@ -498,15 +497,15 @@
 
 // HandleCaveatValidationResponse handles the response to caveat validation
 // requests.
-func (c *Controller) HandleCaveatValidationResponse(id int32, data string) {
+func (c *Controller) HandleCaveatValidationResponse(ctx *context.T, id int32, data string) {
 	c.Lock()
 	server, ok := c.flowMap[id].(*server.Server)
 	c.Unlock()
 	if !ok {
-		vlog.Errorf("unexpected result from JavaScript. No server found matching id %d.", id)
+		ctx.Errorf("unexpected result from JavaScript. No server found matching id %d.", id)
 		return // ignore unknown server
 	}
-	server.HandleCaveatValidationResponse(id, data)
+	server.HandleCaveatValidationResponse(ctx, id, data)
 }
 
 // HandleVeyronRequest starts a vanadium rpc and returns before the rpc has been completed.
@@ -526,7 +525,7 @@
 		w.Error(verror.Convert(verror.ErrInternal, ctx, err))
 		return
 	}
-	vlog.VI(2).Infof("Rpc: %s.%s(..., streaming=%v)", msg.Name, msg.Method, msg.IsStreaming)
+	ctx.VI(2).Infof("Rpc: %s.%s(..., streaming=%v)", msg.Name, msg.Method, msg.IsStreaming)
 	spanName := fmt.Sprintf("<wspr>%q.%s", msg.Name, msg.Method)
 	ctx, span := vtrace.WithContinuedTrace(ctx, spanName, msg.TraceRequest)
 	ctx = i18n.WithLangID(ctx, i18n.LangID(msg.Context.Language))
@@ -578,7 +577,7 @@
 
 // HandleVeyronCancellation cancels the request corresponding to the
 // given id if it is still outstanding.
-func (c *Controller) HandleVeyronCancellation(id int32) {
+func (c *Controller) HandleVeyronCancellation(ctx *context.T, id int32) {
 	c.Lock()
 	defer c.Unlock()
 	if request, ok := c.outstandingRequests[id]; ok && request.cancel != nil {
@@ -587,14 +586,14 @@
 }
 
 // CloseStream closes the stream for a given id.
-func (c *Controller) CloseStream(id int32) {
+func (c *Controller) CloseStream(ctx *context.T, id int32) {
 	c.Lock()
 	defer c.Unlock()
 	if request, ok := c.outstandingRequests[id]; ok && request.stream != nil {
 		request.stream.end()
 		return
 	}
-	vlog.Errorf("close called on non-existent call: %v", id)
+	ctx.Errorf("close called on non-existent call: %v", id)
 }
 
 func (c *Controller) maybeCreateServer(serverId uint32, opts ...rpc.ServerOpt) (*server.Server, error) {
@@ -613,37 +612,37 @@
 
 // HandleLookupResponse handles the result of a Dispatcher.Lookup call that was
 // run by the Javascript server.
-func (c *Controller) HandleLookupResponse(id int32, data string) {
+func (c *Controller) HandleLookupResponse(ctx *context.T, id int32, data string) {
 	c.Lock()
 	server, ok := c.flowMap[id].(*server.Server)
 	c.Unlock()
 	if !ok {
-		vlog.Errorf("unexpected result from JavaScript. No channel "+
+		ctx.Errorf("unexpected result from JavaScript. No channel "+
 			"for MessageId: %d exists. Ignoring the results.", id)
 		//Ignore unknown responses that don't belong to any channel
 		return
 	}
-	server.HandleLookupResponse(id, data)
+	server.HandleLookupResponse(ctx, id, data)
 }
 
 // HandleAuthResponse handles the result of a Authorizer.Authorize call that was
 // run by the Javascript server.
-func (c *Controller) HandleAuthResponse(id int32, data string) {
+func (c *Controller) HandleAuthResponse(ctx *context.T, id int32, data string) {
 	c.Lock()
 	server, ok := c.flowMap[id].(*server.Server)
 	c.Unlock()
 	if !ok {
-		vlog.Errorf("unexpected result from JavaScript. No channel "+
+		ctx.Errorf("unexpected result from JavaScript. No channel "+
 			"for MessageId: %d exists. Ignoring the results.", id)
 		//Ignore unknown responses that don't belong to any channel
 		return
 	}
-	server.HandleAuthResponse(id, data)
+	server.HandleAuthResponse(ctx, id, data)
 }
 
 // Serve instructs WSPR to start listening for calls on behalf
 // of a javascript server.
-func (c *Controller) Serve(_ *context.T, _ rpc.ServerCall, name string, serverId uint32, rpcServerOpts []RpcServerOption) error {
+func (c *Controller) Serve(ctx *context.T, _ rpc.ServerCall, name string, serverId uint32, rpcServerOpts []RpcServerOption) error {
 
 	opts, err := c.serverOpts(rpcServerOpts)
 	if err != nil {
@@ -653,7 +652,7 @@
 	if err != nil {
 		return verror.Convert(verror.ErrInternal, nil, err)
 	}
-	vlog.VI(2).Infof("serving under name: %q", name)
+	ctx.VI(2).Infof("serving under name: %q", name)
 	if err := server.Serve(name); err != nil {
 		return verror.Convert(verror.ErrInternal, nil, err)
 	}
@@ -706,17 +705,17 @@
 
 // HandleServerResponse handles the completion of outstanding calls to JavaScript services
 // by filling the corresponding channel with the result from JavaScript.
-func (c *Controller) HandleServerResponse(id int32, data string) {
+func (c *Controller) HandleServerResponse(ctx *context.T, id int32, data string) {
 	c.Lock()
 	server, ok := c.flowMap[id].(*server.Server)
 	c.Unlock()
 	if !ok {
-		vlog.Errorf("unexpected result from JavaScript. No channel "+
+		ctx.Errorf("unexpected result from JavaScript. No channel "+
 			"for MessageId: %d exists. Ignoring the results.", id)
 		//Ignore unknown responses that don't belong to any channel
 		return
 	}
-	server.HandleServerResponse(id, data)
+	server.HandleServerResponse(ctx, id, data)
 }
 
 // getSignature uses the signature manager to get and cache the signature of a remote server.
@@ -837,12 +836,12 @@
 }
 
 // HandleGranterResponse handles the result of a Granter request.
-func (c *Controller) HandleGranterResponse(id int32, data string) {
+func (c *Controller) HandleGranterResponse(ctx *context.T, id int32, data string) {
 	c.Lock()
 	granterStr, ok := c.flowMap[id].(*granterStream)
 	c.Unlock()
 	if !ok {
-		vlog.Errorf("unexpected result from JavaScript. Flow was not a granter "+
+		ctx.Errorf("unexpected result from JavaScript. Flow was not a granter "+
 			"stream for MessageId: %d exists. Ignoring the results.", id)
 		//Ignore unknown responses that don't belong to any channel
 		return
@@ -850,12 +849,12 @@
 	granterStr.Send(data)
 }
 
-func (c *Controller) HandleTypeMessage(data string) {
+func (c *Controller) HandleTypeMessage(ctx *context.T, data string) {
 	c.typeReader.Add(data)
 }
 
 func (c *Controller) RemoteBlessings(ctx *context.T, _ rpc.ServerCall, name, method string) ([]string, error) {
-	vlog.VI(2).Infof("requesting remote blessings for %q", name)
+	ctx.VI(2).Infof("requesting remote blessings for %q", name)
 
 	cctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
@@ -886,7 +885,7 @@
 	id := c.lastGeneratedId
 	c.lastGeneratedId += 2
 	if err := c.writerCreator(id).Send(lib.ResponseBlessingsCacheMessage, messages); err != nil {
-		vlog.Errorf("unexpected error sending blessings cache message: %v", err)
+		c.ctx.Errorf("unexpected error sending blessings cache message: %v", err)
 	}
 }
 
diff --git a/services/wspr/internal/app/app_test.go b/services/wspr/internal/app/app_test.go
index 69cc32e..11e1793 100644
--- a/services/wspr/internal/app/app_test.go
+++ b/services/wspr/internal/app/app_test.go
@@ -176,9 +176,9 @@
 		}
 		go func() {
 			for _, value := range testCase.streamingInputs {
-				controller.SendOnStream(0, lib.HexVomEncodeOrDie(value, nil), &writer)
+				controller.SendOnStream(ctx, 0, lib.HexVomEncodeOrDie(value, nil), &writer)
 			}
-			controller.CloseStream(0)
+			controller.CloseStream(ctx, 0)
 		}()
 	}
 
@@ -306,11 +306,12 @@
 }
 
 type typeEncoderWriter struct {
-	c *Controller
+	c   *Controller
+	ctx *context.T
 }
 
 func (t *typeEncoderWriter) Write(p []byte) (int, error) {
-	t.c.HandleTypeMessage(hex.EncodeToString(p))
+	t.c.HandleTypeMessage(t.ctx, hex.EncodeToString(p))
 	return len(p), nil
 }
 
@@ -356,7 +357,7 @@
 	}
 
 	v23.GetNamespace(controller.Context()).SetRoots(mtName)
-	typeStream := &typeEncoderWriter{c: controller}
+	typeStream := &typeEncoderWriter{c: controller, ctx: controller.Context()}
 	typeEncoder := vom.NewTypeEncoder(typeStream)
 	req, err := makeRequest(typeEncoder, RpcRequest{
 		Name:       "__controller",
@@ -420,6 +421,7 @@
 		controllerReady:      sync.RWMutex{},
 		flowCount:            2,
 		typeReader:           lib.NewTypeReader(),
+		ctx:                  ctx,
 	}
 	mock.typeDecoder = vom.NewTypeDecoder(mock.typeReader)
 	rt, err := serveServer(ctx, mock, func(controller *Controller) {
@@ -428,7 +430,7 @@
 
 	mock.typeEncoder = rt.typeEncoder
 	defer rt.proxyShutdown()
-	defer rt.controller.Cleanup()
+	defer rt.controller.Cleanup(ctx)
 
 	if err != nil {
 		t.Fatalf("could not serve server %v", err)
diff --git a/services/wspr/internal/app/messaging.go b/services/wspr/internal/app/messaging.go
index aa9c05a..5389996 100644
--- a/services/wspr/internal/app/messaging.go
+++ b/services/wspr/internal/app/messaging.go
@@ -10,10 +10,10 @@
 	"path/filepath"
 	"runtime"
 
+	"v.io/v23/context"
 	"v.io/v23/verror"
 	"v.io/v23/vom"
 	"v.io/v23/vtrace"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/wspr/internal/lib"
 )
 
@@ -106,28 +106,28 @@
 	case VeyronRequestMessage:
 		c.HandleVeyronRequest(ctx, msg.Id, msg.Data, w)
 	case CancelMessage:
-		go c.HandleVeyronCancellation(msg.Id)
+		go c.HandleVeyronCancellation(ctx, msg.Id)
 	case StreamingValueMessage:
 		// SendOnStream queues up the message to be sent, but doesn't do the send
 		// on this goroutine.  We need to queue the messages synchronously so that
 		// the order is preserved.
-		c.SendOnStream(msg.Id, msg.Data, w)
+		c.SendOnStream(ctx, msg.Id, msg.Data, w)
 	case StreamCloseMessage:
-		c.CloseStream(msg.Id)
+		c.CloseStream(ctx, msg.Id)
 
 	case ServerResponseMessage:
-		go c.HandleServerResponse(msg.Id, msg.Data)
+		go c.HandleServerResponse(ctx, msg.Id, msg.Data)
 	case LookupResponseMessage:
-		go c.HandleLookupResponse(msg.Id, msg.Data)
+		go c.HandleLookupResponse(ctx, msg.Id, msg.Data)
 	case AuthResponseMessage:
-		go c.HandleAuthResponse(msg.Id, msg.Data)
+		go c.HandleAuthResponse(ctx, msg.Id, msg.Data)
 	case CaveatValidationResponse:
-		go c.HandleCaveatValidationResponse(msg.Id, msg.Data)
+		go c.HandleCaveatValidationResponse(ctx, msg.Id, msg.Data)
 	case GranterResponseMessage:
-		go c.HandleGranterResponse(msg.Id, msg.Data)
+		go c.HandleGranterResponse(ctx, msg.Id, msg.Data)
 	case TypeMessage:
 		// These messages need to be handled in order so they are done in line.
-		c.HandleTypeMessage(msg.Data)
+		c.HandleTypeMessage(ctx, msg.Data)
 	default:
 		w.Error(verror.New(errUnknownMessageType, ctx, msg.Type))
 	}
@@ -152,11 +152,11 @@
 
 // FormatAsVerror formats an error as a verror.
 // This also logs the error.
-func FormatAsVerror(err error) error {
+func FormatAsVerror(ctx *context.T, err error) error {
 	verr := verror.Convert(verror.ErrUnknown, nil, err)
 
 	// Also log the error but write internal errors at a more severe log level
-	var logLevel vlog.Level = 2
+	logLevel := 2
 	logErr := fmt.Sprintf("%v", verr)
 
 	// Prefix the message with the code locations associated with verr,
@@ -178,7 +178,7 @@
 	if verror.ErrorID(verr) == verror.ErrInternal.ID {
 		logLevel = 2
 	}
-	vlog.VI(logLevel).Info(logErr)
+	ctx.VI(logLevel).Info(logErr)
 
 	return verr
 }
diff --git a/services/wspr/internal/app/mock_jsServer_test.go b/services/wspr/internal/app/mock_jsServer_test.go
index 196b119..b9c60ee 100644
--- a/services/wspr/internal/app/mock_jsServer_test.go
+++ b/services/wspr/internal/app/mock_jsServer_test.go
@@ -13,6 +13,7 @@
 	"sync"
 	"testing"
 
+	"v.io/v23/context"
 	"v.io/v23/vdl"
 	"v.io/v23/vdlroot/signature"
 	"v.io/v23/verror"
@@ -50,22 +51,24 @@
 	typeDecoder *vom.TypeDecoder
 
 	typeEncoder *vom.TypeEncoder
+
+	ctx *context.T
 }
 
 func (m *mockJSServer) Send(responseType lib.ResponseType, msg interface{}) error {
 	switch responseType {
 	case lib.ResponseDispatcherLookup:
-		return m.handleDispatcherLookup(msg)
+		return m.handleDispatcherLookup(m.ctx, msg)
 	case lib.ResponseAuthRequest:
-		return m.handleAuthRequest(msg)
+		return m.handleAuthRequest(m.ctx, msg)
 	case lib.ResponseServerRequest:
-		return m.handleServerRequest(msg)
+		return m.handleServerRequest(m.ctx, msg)
 	case lib.ResponseValidate:
-		return m.handleValidationRequest(msg)
+		return m.handleValidationRequest(m.ctx, msg)
 	case lib.ResponseStream:
-		return m.handleStream(msg)
+		return m.handleStream(m.ctx, msg)
 	case lib.ResponseStreamClose:
-		return m.handleStreamClose(msg)
+		return m.handleStreamClose(m.ctx, msg)
 	case lib.ResponseFinal:
 		if m.receivedResponse != nil {
 			return fmt.Errorf("Two responses received. First was: %#v. Second was: %#v", m.receivedResponse, msg)
@@ -117,7 +120,7 @@
 func (m *mockJSServer) handleTypeMessage(v interface{}) {
 	m.typeReader.Add(hex.EncodeToString(v.([]byte)))
 }
-func (m *mockJSServer) handleDispatcherLookup(v interface{}) error {
+func (m *mockJSServer) handleDispatcherLookup(ctx *context.T, v interface{}) error {
 	defer func() {
 		m.flowCount += 2
 	}()
@@ -126,12 +129,12 @@
 
 	msg, err := normalize(v)
 	if err != nil {
-		m.controller.HandleLookupResponse(m.flowCount, internalErr(err, m.typeEncoder))
+		m.controller.HandleLookupResponse(ctx, m.flowCount, internalErr(err, m.typeEncoder))
 		return nil
 	}
 	expected := map[string]interface{}{"serverId": 0.0, "suffix": "adder"}
 	if !reflect.DeepEqual(msg, expected) {
-		m.controller.HandleLookupResponse(m.flowCount, internalErr(fmt.Sprintf("got: %v, want: %v", msg, expected), m.typeEncoder))
+		m.controller.HandleLookupResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("got: %v, want: %v", msg, expected), m.typeEncoder))
 		return nil
 	}
 	lookupReply := lib.HexVomEncodeOrDie(server.LookupReply{
@@ -139,7 +142,7 @@
 		Signature:     m.serviceSignature,
 		HasAuthorizer: m.hasAuthorizer,
 	}, m.typeEncoder)
-	m.controller.HandleLookupResponse(m.flowCount, lookupReply)
+	m.controller.HandleLookupResponse(ctx, m.flowCount, lookupReply)
 	return nil
 }
 
@@ -147,57 +150,57 @@
 	return ep != ""
 }
 
-func (m *mockJSServer) handleAuthRequest(v interface{}) error {
+func (m *mockJSServer) handleAuthRequest(ctx *context.T, v interface{}) error {
 	defer func() {
 		m.flowCount += 2
 	}()
 
 	m.hasCalledAuth = true
 	if !m.hasAuthorizer {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr("unexpected auth request", m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr("unexpected auth request", m.typeEncoder))
 		return nil
 	}
 
 	var msg server.AuthRequest
 	if err := lib.HexVomDecode(v.(string), &msg, m.typeDecoder); err != nil {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("error decoding %v:", err), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("error decoding %v:", err), m.typeEncoder))
 		return nil
 	}
 
 	if msg.Handle != 0 {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("unexpected handled: %v", msg.Handle), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("unexpected handled: %v", msg.Handle), m.typeEncoder))
 		return nil
 	}
 
 	call := msg.Call
 	if field, got, want := "Method", call.Method, lib.LowercaseFirstCharacter(m.method); got != want {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
 		return nil
 	}
 
 	if field, got, want := "Suffix", call.Suffix, "adder"; got != want {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
 		return nil
 	}
 
 	// We expect localBlessings and remoteBlessings to be a non-zero id
 	if call.LocalBlessings == 0 {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("bad local blessing: %v", call.LocalBlessings), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("bad local blessing: %v", call.LocalBlessings), m.typeEncoder))
 		return nil
 	}
 	if call.RemoteBlessings == 0 {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("bad remote blessing: %v", call.RemoteBlessings), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("bad remote blessing: %v", call.RemoteBlessings), m.typeEncoder))
 		return nil
 	}
 
 	// We expect endpoints to be set
 	if !validateEndpoint(call.LocalEndpoint) {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("bad endpoint:%v", call.LocalEndpoint), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("bad endpoint:%v", call.LocalEndpoint), m.typeEncoder))
 		return nil
 	}
 
 	if !validateEndpoint(call.RemoteEndpoint) {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("bad endpoint:%v", call.RemoteEndpoint), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("bad endpoint:%v", call.RemoteEndpoint), m.typeEncoder))
 		return nil
 	}
 
@@ -205,33 +208,33 @@
 		Err: m.authError,
 	}, m.typeEncoder)
 
-	m.controller.HandleAuthResponse(m.flowCount, authReply)
+	m.controller.HandleAuthResponse(ctx, m.flowCount, authReply)
 	return nil
 }
 
-func (m *mockJSServer) handleServerRequest(v interface{}) error {
+func (m *mockJSServer) handleServerRequest(ctx *context.T, v interface{}) error {
 	defer func() {
 		m.flowCount += 2
 	}()
 
 	if m.hasCalledAuth != m.hasAuthorizer {
-		m.controller.HandleServerResponse(m.flowCount, internalErr("authorizer hasn't been called yet", m.typeEncoder))
+		m.controller.HandleServerResponse(ctx, m.flowCount, internalErr("authorizer hasn't been called yet", m.typeEncoder))
 		return nil
 	}
 
 	var msg server.ServerRpcRequest
 	if err := lib.HexVomDecode(v.(string), &msg, m.typeDecoder); err != nil {
-		m.controller.HandleServerResponse(m.flowCount, internalErr(err, m.typeEncoder))
+		m.controller.HandleServerResponse(ctx, m.flowCount, internalErr(err, m.typeEncoder))
 		return nil
 	}
 
 	if field, got, want := "Method", msg.Method, lib.LowercaseFirstCharacter(m.method); got != want {
-		m.controller.HandleServerResponse(m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
+		m.controller.HandleServerResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
 		return nil
 	}
 
 	if field, got, want := "Handle", msg.Handle, int32(0); got != want {
-		m.controller.HandleServerResponse(m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
+		m.controller.HandleServerResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
 		return nil
 	}
 
@@ -242,23 +245,23 @@
 		}
 	}
 	if field, got, want := "Args", vals, m.inArgs; !reflectutil.DeepEqual(got, want, &reflectutil.DeepEqualOpts{SliceEqNilEmpty: true}) {
-		m.controller.HandleServerResponse(m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
+		m.controller.HandleServerResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
 		return nil
 	}
 
 	call := msg.Call.SecurityCall
 	if field, got, want := "Suffix", call.Suffix, "adder"; got != want {
-		m.controller.HandleServerResponse(m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
+		m.controller.HandleServerResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("unexpected value for %s: got %v, want %v", field, got, want), m.typeEncoder))
 		return nil
 	}
 
 	// We expect localBlessings and remoteBlessings to be a non-zero id
 	if call.LocalBlessings == 0 {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("bad local blessing: %v", call.LocalBlessings), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("bad local blessing: %v", call.LocalBlessings), m.typeEncoder))
 		return nil
 	}
 	if call.RemoteBlessings == 0 {
-		m.controller.HandleAuthResponse(m.flowCount, internalErr(fmt.Sprintf("bad remote blessing: %v", call.RemoteBlessings), m.typeEncoder))
+		m.controller.HandleAuthResponse(ctx, m.flowCount, internalErr(fmt.Sprintf("bad remote blessing: %v", call.RemoteBlessings), m.typeEncoder))
 		return nil
 	}
 
@@ -266,11 +269,11 @@
 
 	// We don't return the final response until the stream is closed.
 	m.sender.Add(1)
-	go m.sendServerStream()
+	go m.sendServerStream(ctx)
 	return nil
 }
 
-func (m *mockJSServer) handleValidationRequest(v interface{}) error {
+func (m *mockJSServer) handleValidationRequest(ctx *context.T, v interface{}) error {
 	defer func() {
 		m.flowCount += 2
 	}()
@@ -283,21 +286,21 @@
 	res := lib.HexVomEncodeOrDie(resp, m.typeEncoder)
 
 	m.controllerReady.RLock()
-	m.controller.HandleCaveatValidationResponse(m.flowCount, res)
+	m.controller.HandleCaveatValidationResponse(ctx, m.flowCount, res)
 	m.controllerReady.RUnlock()
 	return nil
 }
 
-func (m *mockJSServer) sendServerStream() {
+func (m *mockJSServer) sendServerStream(ctx *context.T) {
 	defer m.sender.Done()
 	m.controllerReady.RLock()
 	for _, v := range m.serverStream {
-		m.controller.SendOnStream(m.rpcFlow, lib.HexVomEncodeOrDie(v, m.typeEncoder), m)
+		m.controller.SendOnStream(ctx, m.rpcFlow, lib.HexVomEncodeOrDie(v, m.typeEncoder), m)
 	}
 	m.controllerReady.RUnlock()
 }
 
-func (m *mockJSServer) handleStream(msg interface{}) error {
+func (m *mockJSServer) handleStream(ctx *context.T, msg interface{}) error {
 	smsg, ok := msg.(string)
 	if !ok || len(m.expectedClientStream) == 0 {
 		m.t.Errorf("unexpected stream message: %v", msg)
@@ -312,7 +315,7 @@
 	return nil
 }
 
-func (m *mockJSServer) handleStreamClose(msg interface{}) error {
+func (m *mockJSServer) handleStreamClose(ctx *context.T, msg interface{}) error {
 	m.sender.Wait()
 	reply := lib.ServerRpcReply{
 		Results: []*vdl.Value{m.finalResponse},
@@ -320,7 +323,7 @@
 	}
 
 	m.controllerReady.RLock()
-	m.controller.HandleServerResponse(m.rpcFlow, lib.HexVomEncodeOrDie(reply, m.typeEncoder))
+	m.controller.HandleServerResponse(ctx, m.rpcFlow, lib.HexVomEncodeOrDie(reply, m.typeEncoder))
 	m.controllerReady.RUnlock()
 	return nil
 }
diff --git a/services/wspr/internal/browspr/browspr.go b/services/wspr/internal/browspr/browspr.go
index 8971fc3..409ea62 100644
--- a/services/wspr/internal/browspr/browspr.go
+++ b/services/wspr/internal/browspr/browspr.go
@@ -15,7 +15,6 @@
 	"v.io/v23/rpc"
 	"v.io/v23/vdl"
 	"v.io/v23/vtrace"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/wspr/internal/account"
 	"v.io/x/ref/services/wspr/internal/app"
 	"v.io/x/ref/services/wspr/internal/principal"
@@ -42,10 +41,10 @@
 	identd string,
 	wsNamespaceRoots []string) *Browspr {
 	if listenSpec.Proxy == "" {
-		vlog.Fatalf("a vanadium proxy must be set")
+		ctx.Fatalf("a vanadium proxy must be set")
 	}
 	if identd == "" {
-		vlog.Fatalf("an identd server must be set")
+		ctx.Fatalf("an identd server must be set")
 	}
 
 	browspr := &Browspr{
@@ -60,7 +59,7 @@
 	var err error
 	p := v23.GetPrincipal(ctx)
 	if browspr.principalManager, err = principal.NewPrincipalManager(p, &principal.InMemorySerializer{}); err != nil {
-		vlog.Fatalf("principal.NewPrincipalManager failed: %s", err)
+		ctx.Fatalf("principal.NewPrincipalManager failed: %s", err)
 	}
 
 	browspr.accountManager = account.NewAccountManager(identd, browspr.principalManager)
@@ -122,7 +121,7 @@
 		// We must unlock the mutex before calling cleanunp, otherwise
 		// browspr deadlocks.
 		b.mu.Unlock()
-		pipe.cleanup()
+		pipe.cleanup(b.ctx)
 
 		b.mu.Lock()
 		delete(b.activeInstances, msg.InstanceId)
@@ -159,8 +158,8 @@
 	if err := vdl.Convert(&msg, val); err != nil {
 		return nil, fmt.Errorf("HandleAuthAssociateAccountRpc did not receive AssociateAccountMessage, received: %v, %v", val, err)
 	}
-
-	if err := b.accountManager.AssociateAccount(msg.Origin, msg.Account, msg.Caveats); err != nil {
+	ctx, _ := vtrace.WithNewTrace(b.ctx)
+	if err := b.accountManager.AssociateAccount(ctx, msg.Origin, msg.Account, msg.Caveats); err != nil {
 		return nil, err
 	}
 	return nil, nil
diff --git a/services/wspr/internal/browspr/browspr_test.go b/services/wspr/internal/browspr/browspr_test.go
index 5841efa..20b1466 100644
--- a/services/wspr/internal/browspr/browspr_test.go
+++ b/services/wspr/internal/browspr/browspr_test.go
@@ -178,7 +178,7 @@
 	if err := browspr.principalManager.AddAccount(accountName, bp.BlessingStore().Default()); err != nil {
 		t.Fatalf("Failed to add account: %v", err)
 	}
-	if err := browspr.accountManager.AssociateAccount(msgOrigin, accountName, nil); err != nil {
+	if err := browspr.accountManager.AssociateAccount(ctx, msgOrigin, accountName, nil); err != nil {
 		t.Fatalf("Failed to associate account: %v", err)
 	}
 
diff --git a/services/wspr/internal/browspr/pipe.go b/services/wspr/internal/browspr/pipe.go
index 34280b4..3086761 100644
--- a/services/wspr/internal/browspr/pipe.go
+++ b/services/wspr/internal/browspr/pipe.go
@@ -5,7 +5,7 @@
 package browspr
 
 import (
-	"v.io/x/lib/vlog"
+	"v.io/v23/context"
 	"v.io/x/ref/services/wspr/internal/app"
 	"v.io/x/ref/services/wspr/internal/lib"
 )
@@ -31,16 +31,16 @@
 		// TODO(nlacasse, bjornick): This code should go away once we
 		// start requiring authentication.  At that point, we should
 		// just return an error to the client.
-		vlog.Errorf("No principal associated with origin %v, creating a new principal with self-signed blessing from browspr: %v", origin, err)
+		b.ctx.Errorf("No principal associated with origin %v, creating a new principal with self-signed blessing from browspr: %v", origin, err)
 
 		dummyAccount, err := b.principalManager.DummyAccount()
 		if err != nil {
-			vlog.Errorf("principalManager.DummyAccount() failed: %v", err)
+			b.ctx.Errorf("principalManager.DummyAccount() failed: %v", err)
 			return nil
 		}
 
-		if err := b.accountManager.AssociateAccount(origin, dummyAccount, nil); err != nil {
-			vlog.Errorf("accountManager.AssociateAccount(%v, %v, %v) failed: %v", origin, dummyAccount, nil, err)
+		if err := b.accountManager.AssociateAccount(b.ctx, origin, dummyAccount, nil); err != nil {
+			b.ctx.Errorf("accountManager.AssociateAccount(%v, %v, %v) failed: %v", origin, dummyAccount, nil, err)
 			return nil
 		}
 		p, err = b.accountManager.LookupPrincipal(origin)
@@ -63,7 +63,7 @@
 
 	pipe.controller, err = app.NewController(b.ctx, pipe.createWriter, &listenSpec, namespaceRoots, p)
 	if err != nil {
-		vlog.Errorf("Could not create controller: %v", err)
+		b.ctx.Errorf("Could not create controller: %v", err)
 		return nil
 	}
 
@@ -77,9 +77,9 @@
 	}
 }
 
-func (p *pipe) cleanup() {
-	vlog.VI(0).Info("Cleaning up pipe")
-	p.controller.Cleanup()
+func (p *pipe) cleanup(ctx *context.T) {
+	ctx.VI(0).Info("Cleaning up pipe")
+	p.controller.Cleanup(ctx)
 }
 
 func (p *pipe) handleMessage(msg app.Message) error {
diff --git a/services/wspr/internal/browspr/writer.go b/services/wspr/internal/browspr/writer.go
index ed4fc66..47db65f 100644
--- a/services/wspr/internal/browspr/writer.go
+++ b/services/wspr/internal/browspr/writer.go
@@ -25,5 +25,5 @@
 }
 
 func (w *postMessageWriter) Error(err error) {
-	w.Send(lib.ResponseError, app.FormatAsVerror(err))
+	w.Send(lib.ResponseError, app.FormatAsVerror(w.p.browspr.ctx, err))
 }
diff --git a/services/wspr/internal/rpc/server/dispatcher.go b/services/wspr/internal/rpc/server/dispatcher.go
index 1b49fea..96573c9 100644
--- a/services/wspr/internal/rpc/server/dispatcher.go
+++ b/services/wspr/internal/rpc/server/dispatcher.go
@@ -7,11 +7,11 @@
 import (
 	"sync"
 
+	"v.io/v23/context"
 	"v.io/v23/rpc"
 	"v.io/v23/security"
 	"v.io/v23/vdlroot/signature"
 	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/wspr/internal/lib"
 )
 
@@ -118,14 +118,14 @@
 	return invoker, auth, nil
 }
 
-func (d *dispatcher) handleLookupResponse(id int32, data string) {
+func (d *dispatcher) handleLookupResponse(ctx *context.T, id int32, data string) {
 	d.mu.Lock()
 	ch := d.outstandingLookups[id]
 	d.mu.Unlock()
 
 	if ch == nil {
 		d.flowFactory.cleanupFlow(id)
-		vlog.Errorf("unknown invoke request for flow: %d", id)
+		ctx.Errorf("unknown invoke request for flow: %d", id)
 		return
 	}
 
@@ -133,7 +133,7 @@
 	if err := lib.HexVomDecode(data, &lookupReply, d.vomHelper.TypeDecoder()); err != nil {
 		err2 := verror.Convert(verror.ErrInternal, nil, err)
 		lookupReply = LookupReply{Err: err2}
-		vlog.Errorf("unmarshaling invoke request failed: %v, %s", err, data)
+		ctx.Errorf("unmarshaling invoke request failed: %v, %s", err, data)
 	}
 
 	ch <- lookupReply
diff --git a/services/wspr/internal/rpc/server/dispatcher_test.go b/services/wspr/internal/rpc/server/dispatcher_test.go
index b58bc80..5e60164 100644
--- a/services/wspr/internal/rpc/server/dispatcher_test.go
+++ b/services/wspr/internal/rpc/server/dispatcher_test.go
@@ -16,6 +16,7 @@
 	"v.io/v23/vdlroot/signature"
 	"v.io/v23/verror"
 	"v.io/v23/vom"
+	"v.io/x/ref/internal/logger"
 	"v.io/x/ref/services/wspr/internal/lib"
 	"v.io/x/ref/services/wspr/internal/lib/testwriter"
 )
@@ -90,6 +91,9 @@
 }
 
 func TestSuccessfulLookup(t *testing.T) {
+	ctx, cancel := context.RootContext()
+	defer cancel()
+	ctx = context.WithLogger(ctx, logger.Global())
 	flowFactory := &mockFlowFactory{}
 	d := newDispatcher(0, flowFactory, mockInvokerFactory{}, mockAuthorizerFactory{}, mockVomHelper{})
 	expectedSig := []signature.Interface{
@@ -105,7 +109,7 @@
 			HasAuthorizer: false,
 			Signature:     expectedSig,
 		}
-		d.handleLookupResponse(0, lib.HexVomEncodeOrDie(reply, nil))
+		d.handleLookupResponse(ctx, 0, lib.HexVomEncodeOrDie(reply, nil))
 	}()
 
 	invoker, auth, err := d.Lookup("a/b")
@@ -139,6 +143,9 @@
 }
 
 func TestSuccessfulLookupWithAuthorizer(t *testing.T) {
+	ctx, cancel := context.RootContext()
+	defer cancel()
+	ctx = context.WithLogger(ctx, logger.Global())
 	flowFactory := &mockFlowFactory{}
 	d := newDispatcher(0, flowFactory, mockInvokerFactory{}, mockAuthorizerFactory{}, mockVomHelper{})
 	expectedSig := []signature.Interface{
@@ -154,7 +161,7 @@
 			HasAuthorizer: true,
 			Signature:     expectedSig,
 		}
-		d.handleLookupResponse(0, lib.HexVomEncodeOrDie(reply, nil))
+		d.handleLookupResponse(ctx, 0, lib.HexVomEncodeOrDie(reply, nil))
 	}()
 
 	invoker, auth, err := d.Lookup("a/b")
@@ -188,6 +195,9 @@
 }
 
 func TestFailedLookup(t *testing.T) {
+	ctx, cancel := context.RootContext()
+	defer cancel()
+	ctx = context.WithLogger(ctx, logger.Global())
 	flowFactory := &mockFlowFactory{}
 	d := newDispatcher(0, flowFactory, mockInvokerFactory{}, mockAuthorizerFactory{}, mockVomHelper{})
 	go func() {
@@ -198,7 +208,7 @@
 		reply := LookupReply{
 			Err: verror.New(verror.ErrNoExist, nil),
 		}
-		d.handleLookupResponse(0, lib.HexVomEncodeOrDie(reply, nil))
+		d.handleLookupResponse(ctx, 0, lib.HexVomEncodeOrDie(reply, nil))
 	}()
 
 	_, _, err := d.Lookup("a/b")
diff --git a/services/wspr/internal/rpc/server/server.go b/services/wspr/internal/rpc/server/server.go
index 2488069..6205d91 100644
--- a/services/wspr/internal/rpc/server/server.go
+++ b/services/wspr/internal/rpc/server/server.go
@@ -23,7 +23,6 @@
 	"v.io/v23/verror"
 	"v.io/v23/vom"
 	"v.io/v23/vtrace"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/wspr/internal/lib"
 	"v.io/x/ref/services/wspr/internal/principal"
 )
@@ -95,6 +94,8 @@
 	// statusClose will be closed when the server is shutting down, this will
 	// cause the status poller to exit.
 	statusClose chan struct{}
+
+	ctx *context.T
 }
 
 type serverContextKey struct{}
@@ -114,6 +115,7 @@
 	if server.server, err = v23.NewServer(ctx, opts...); err != nil {
 		return nil, err
 	}
+	server.ctx = ctx
 	return server, nil
 }
 
@@ -181,7 +183,7 @@
 			return errHandler(err)
 		}
 
-		vlog.VI(3).Infof("calling method %q with args %v, MessageID %d assigned\n", methodName, args, flow.ID)
+		ctx.VI(3).Infof("calling method %q with args %v, MessageID %d assigned\n", methodName, args, flow.ID)
 
 		// Watch for cancellation.
 		go func() {
@@ -285,7 +287,7 @@
 			return errHandler(err)
 		}
 
-		vlog.VI(3).Infof("calling method 'Glob__' with args %v, MessageID %d assigned\n", []interface{}{pattern}, flow.ID)
+		ctx.VI(3).Infof("calling method 'Glob__' with args %v, MessageID %d assigned\n", []interface{}{pattern}, flow.ID)
 
 		// Watch for cancellation.
 		go func() {
@@ -322,7 +324,7 @@
 			return
 		}
 	}
-	vlog.VI(1).Infof("Error reading from stream: %v\n", err)
+	s.ctx.VI(1).Infof("Error reading from stream: %v\n", err)
 	s.outstandingRequestLock.Lock()
 	_, found := s.outstandingServerRequests[flow.ID]
 	s.outstandingRequestLock.Unlock()
@@ -387,7 +389,7 @@
 	}()
 
 	if err := flow.Writer.Send(lib.ResponseValidate, req); err != nil {
-		vlog.VI(2).Infof("Failed to send validate response: %v", err)
+		ctx.VI(2).Infof("Failed to send validate response: %v", err)
 		replyChan <- makeListOfErrors(len(cavs), err)
 	}
 
@@ -404,7 +406,7 @@
 		return makeListOfErrors(len(cavs), NewErrCaveatValidationTimeout(ctx))
 	case reply := <-replyChan:
 		if len(reply) != len(cavs) {
-			vlog.VI(2).Infof("Wspr caveat validator received %d results from javascript but expected %d", len(reply), len(cavs))
+			ctx.VI(2).Infof("Wspr caveat validator received %d results from javascript but expected %d", len(reply), len(cavs))
 			return makeListOfErrors(len(cavs), NewErrInvalidValidationResponseFromJavascript(ctx))
 		}
 
@@ -551,7 +553,7 @@
 			Language: string(i18n.GetLangID(ctx)),
 		},
 	}
-	vlog.VI(0).Infof("Sending out auth request for %v, %v", flow.ID, message)
+	ctx.VI(0).Infof("Sending out auth request for %v, %v", flow.ID, message)
 
 	vomMessage, err := lib.HexVomEncode(message, s.helper.TypeEncoder())
 	if err != nil {
@@ -561,7 +563,7 @@
 	}
 
 	err = <-replyChan
-	vlog.VI(0).Infof("going to respond with %v", err)
+	ctx.VI(0).Infof("going to respond with %v", err)
 	s.outstandingRequestLock.Lock()
 	delete(s.outstandingAuthRequests, flow.ID)
 	s.outstandingRequestLock.Unlock()
@@ -632,10 +634,10 @@
 	return ch
 }
 
-func (s *Server) HandleServerResponse(id int32, data string) {
+func (s *Server) HandleServerResponse(ctx *context.T, id int32, data string) {
 	ch := s.popServerRequest(id)
 	if ch == nil {
-		vlog.Errorf("unexpected result from JavaScript. No channel "+
+		ctx.Errorf("unexpected result from JavaScript. No channel "+
 			"for MessageId: %d exists. Ignoring the results.", id)
 		// Ignore unknown responses that don't belong to any channel
 		return
@@ -647,7 +649,7 @@
 		reply.Err = err
 	}
 
-	vlog.VI(0).Infof("response received from JavaScript server for "+
+	ctx.VI(0).Infof("response received from JavaScript server for "+
 		"MessageId %d with result %v", id, reply)
 	s.helper.CleanupFlow(id)
 	if reply.Err != nil {
@@ -657,16 +659,16 @@
 	ch <- &reply
 }
 
-func (s *Server) HandleLookupResponse(id int32, data string) {
-	s.dispatcher.handleLookupResponse(id, data)
+func (s *Server) HandleLookupResponse(ctx *context.T, id int32, data string) {
+	s.dispatcher.handleLookupResponse(ctx, id, data)
 }
 
-func (s *Server) HandleAuthResponse(id int32, data string) {
+func (s *Server) HandleAuthResponse(ctx *context.T, id int32, data string) {
 	s.outstandingRequestLock.Lock()
 	ch := s.outstandingAuthRequests[id]
 	s.outstandingRequestLock.Unlock()
 	if ch == nil {
-		vlog.Errorf("unexpected result from JavaScript. No channel "+
+		ctx.Errorf("unexpected result from JavaScript. No channel "+
 			"for MessageId: %d exists. Ignoring the results(%s)", id, data)
 		// Ignore unknown responses that don't belong to any channel
 		return
@@ -678,7 +680,7 @@
 		reply = AuthReply{Err: err}
 	}
 
-	vlog.VI(0).Infof("response received from JavaScript server for "+
+	ctx.VI(0).Infof("response received from JavaScript server for "+
 		"MessageId %d with result %v", id, reply)
 	s.helper.CleanupFlow(id)
 	// A nil verror.E does not result in an nil error.  Instead, we have create
@@ -691,12 +693,12 @@
 	ch <- err
 }
 
-func (s *Server) HandleCaveatValidationResponse(id int32, data string) {
+func (s *Server) HandleCaveatValidationResponse(ctx *context.T, id int32, data string) {
 	s.outstandingRequestLock.Lock()
 	ch := s.outstandingValidationRequests[id]
 	s.outstandingRequestLock.Unlock()
 	if ch == nil {
-		vlog.Errorf("unexpected result from JavaScript. No channel "+
+		ctx.Errorf("unexpected result from JavaScript. No channel "+
 			"for validation response with MessageId: %d exists. Ignoring the results(%s)", id, data)
 		// Ignore unknown responses that don't belong to any channel
 		return
@@ -704,7 +706,7 @@
 
 	var reply CaveatValidationResponse
 	if err := lib.HexVomDecode(data, &reply, s.helper.TypeDecoder()); err != nil {
-		vlog.Errorf("failed to decode validation response %q: error %v", data, err)
+		ctx.Errorf("failed to decode validation response %q: error %v", data, err)
 		ch <- []error{}
 		return
 	}
diff --git a/services/wspr/wsprlib/pipe.go b/services/wspr/wsprlib/pipe.go
index c8fe142..90c98a3 100644
--- a/services/wspr/wsprlib/pipe.go
+++ b/services/wspr/wsprlib/pipe.go
@@ -12,7 +12,7 @@
 	"time"
 
 	"v.io/v23"
-	"v.io/x/lib/vlog"
+	"v.io/v23/context"
 	"v.io/x/ref/services/wspr/internal/app"
 	"v.io/x/ref/services/wspr/internal/lib"
 
@@ -51,13 +51,13 @@
 
 	if creator == nil {
 		creator = func(id int32) lib.ClientWriter {
-			return &websocketWriter{p: pipe, id: id}
+			return &websocketWriter{p: pipe, id: id, ctx: wspr.ctx}
 		}
 	}
 	pipe.writerCreator = creator
 	origin := req.Header.Get("Origin")
 	if origin == "" {
-		vlog.Errorf("Could not read origin from the request")
+		wspr.ctx.Errorf("Could not read origin from the request")
 		http.Error(w, "Could not read origin from the request", http.StatusBadRequest)
 		return nil
 	}
@@ -65,13 +65,13 @@
 	p, err := wspr.principalManager.Principal(origin)
 	if err != nil {
 		p = v23.GetPrincipal(wspr.ctx)
-		vlog.Errorf("no principal associated with origin %s: %v", origin, err)
+		wspr.ctx.Errorf("no principal associated with origin %s: %v", origin, err)
 		// TODO(bjornick): Send an error to the client when all of the principal stuff is set up.
 	}
 
 	pipe.controller, err = app.NewController(wspr.ctx, creator, wspr.listenSpec, wspr.namespaceRoots, p)
 	if err != nil {
-		vlog.Errorf("Could not create controller: %v", err)
+		wspr.ctx.Errorf("Could not create controller: %v", err)
 		http.Error(w, fmt.Sprintf("Failed to create controller: %v", err), http.StatusInternalServerError)
 		return nil
 	}
@@ -81,9 +81,9 @@
 }
 
 // cleans up any outstanding rpcs.
-func (p *pipe) cleanup() {
-	vlog.VI(0).Info("Cleaning up websocket")
-	p.controller.Cleanup()
+func (p *pipe) cleanup(ctx *context.T) {
+	ctx.VI(0).Info("Cleaning up websocket")
+	p.controller.Cleanup(ctx)
 	p.ws.Close()
 	p.wspr.CleanUpPipe(p.req)
 }
@@ -97,15 +97,15 @@
 	for {
 		msg, ok := <-p.writeQueue
 		if !ok {
-			vlog.Errorf("write queue was closed")
+			p.wspr.ctx.Errorf("write queue was closed")
 			return
 		}
 
 		if msg.messageType == websocket.PingMessage {
-			vlog.Infof("sending ping")
+			p.wspr.ctx.Infof("sending ping")
 		}
 		if err := p.ws.WriteMessage(msg.messageType, msg.buf); err != nil {
-			vlog.Errorf("failed to write bytes: %s", err)
+			p.wspr.ctx.Errorf("failed to write bytes: %s", err)
 		}
 	}
 }
@@ -117,7 +117,7 @@
 		return
 	} else if err != nil {
 		http.Error(w, "Internal Error", 500)
-		vlog.Errorf("websocket upgrade failed: %s", err)
+		p.wspr.ctx.Errorf("websocket upgrade failed: %s", err)
 		return
 	}
 
@@ -132,13 +132,13 @@
 func (p *pipe) pingLoop() {
 	for {
 		time.Sleep(pingInterval)
-		vlog.VI(2).Info("ws: ping")
+		p.wspr.ctx.VI(2).Info("ws: ping")
 		p.writeQueue <- wsMessage{messageType: websocket.PingMessage, buf: []byte{}}
 	}
 }
 
 func (p *pipe) pongHandler(msg string) error {
-	vlog.VI(2).Infof("ws: pong")
+	p.wspr.ctx.VI(2).Infof("ws: pong")
 	p.ws.SetReadDeadline(time.Now().Add(pongTimeout))
 	return nil
 }
@@ -151,19 +151,19 @@
 			break
 		}
 		if err != nil {
-			vlog.VI(1).Infof("websocket receive: %s", err)
+			p.wspr.ctx.VI(1).Infof("websocket receive: %s", err)
 			break
 		}
 
 		if op != websocket.TextMessage {
-			vlog.Errorf("unexpected websocket op: %v", op)
+			p.wspr.ctx.Errorf("unexpected websocket op: %v", op)
 		}
 
 		var msg app.Message
 		decoder := json.NewDecoder(r)
 		if err := decoder.Decode(&msg); err != nil {
 			errMsg := fmt.Sprintf("can't unmarshall JSONMessage: %v", err)
-			vlog.Error(errMsg)
+			p.wspr.ctx.Error(errMsg)
 			p.writeQueue <- wsMessage{messageType: websocket.TextMessage, buf: []byte(errMsg)}
 			continue
 		}
@@ -171,5 +171,5 @@
 		ww := p.writerCreator(msg.Id)
 		p.controller.HandleIncomingMessage(msg, ww)
 	}
-	p.cleanup()
+	p.cleanup(p.wspr.ctx)
 }
diff --git a/services/wspr/wsprlib/writer.go b/services/wspr/wsprlib/writer.go
index ea65970..8c1fabe 100644
--- a/services/wspr/wsprlib/writer.go
+++ b/services/wspr/wsprlib/writer.go
@@ -9,8 +9,8 @@
 	"path/filepath"
 	"runtime"
 
+	"v.io/v23/context"
 	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
 	"v.io/x/ref/services/wspr/internal/app"
 	"v.io/x/ref/services/wspr/internal/lib"
 
@@ -25,8 +25,9 @@
 
 // Implements clientWriter interface for sending messages over websockets.
 type websocketWriter struct {
-	p  *pipe
-	id int32
+	p   *pipe
+	id  int32
+	ctx *context.T
 }
 
 func (w *websocketWriter) Send(messageType lib.ResponseType, data interface{}) error {
@@ -44,7 +45,7 @@
 	verr := verror.Convert(verror.ErrUnknown, nil, err)
 
 	// Also log the error but write internal errors at a more severe log level
-	var logLevel vlog.Level = 2
+	logLevel := 2
 	logErr := fmt.Sprintf("%v", verr)
 
 	// Prefix the message with the code locations associated with verr,
@@ -66,7 +67,7 @@
 	if verror.ErrorID(verr) == verror.ErrInternal.ID {
 		logLevel = 2
 	}
-	vlog.VI(logLevel).Info(logErr)
+	w.ctx.VI(logLevel).Info(logErr)
 
 	w.Send(lib.ResponseError, verr)
 }
diff --git a/services/wspr/wsprlib/wspr.go b/services/wspr/wsprlib/wspr.go
index 0544575..d626ed5 100644
--- a/services/wspr/wsprlib/wspr.go
+++ b/services/wspr/wsprlib/wspr.go
@@ -20,7 +20,6 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/rpc"
-	"v.io/x/lib/vlog"
 
 	"v.io/x/ref/services/wspr/internal/account"
 	"v.io/x/ref/services/wspr/internal/principal"
@@ -60,10 +59,10 @@
 	addr := fmt.Sprintf("127.0.0.1:%d", wspr.httpPort)
 	ln, err := net.Listen("tcp", addr)
 	if err != nil {
-		vlog.Fatalf("Listen failed: %s", err)
+		wspr.ctx.Fatalf("Listen failed: %s", err)
 	}
 	wspr.ln = ln.(*net.TCPListener)
-	vlog.VI(1).Infof("Listening at %s", ln.Addr().String())
+	wspr.ctx.VI(1).Infof("Listening at %s", ln.Addr().String())
 	return ln.Addr()
 }
 
@@ -96,7 +95,7 @@
 	http.Handle("/", http.NotFoundHandler())
 
 	if err := http.Serve(tcpKeepAliveListener{wspr.ln}, nil); err != nil {
-		vlog.Fatalf("Serve failed: %s", err)
+		wspr.ctx.Fatalf("Serve failed: %s", err)
 	}
 }
 
@@ -113,7 +112,7 @@
 // Creates a new WebSocket Proxy object.
 func NewWSPR(ctx *context.T, httpPort int, listenSpec *rpc.ListenSpec, identdEP string, namespaceRoots []string) *WSPR {
 	if listenSpec.Proxy == "" {
-		vlog.Fatalf("a vanadium proxy must be set")
+		ctx.Fatalf("a vanadium proxy must be set")
 	}
 
 	wspr := &WSPR{
@@ -128,7 +127,7 @@
 	p := v23.GetPrincipal(ctx)
 	var err error
 	if wspr.principalManager, err = principal.NewPrincipalManager(p, &principal.InMemorySerializer{}); err != nil {
-		vlog.Fatalf("principal.NewPrincipalManager failed: %s", err)
+		ctx.Fatalf("principal.NewPrincipalManager failed: %s", err)
 	}
 
 	wspr.accountManager = account.NewAccountManager(identdEP, wspr.principalManager)
@@ -137,7 +136,7 @@
 }
 
 func (wspr *WSPR) logAndSendBadReqErr(w http.ResponseWriter, msg string) {
-	vlog.Error(msg)
+	wspr.ctx.Error(msg)
 	http.Error(w, msg, http.StatusBadRequest)
 	return
 }
@@ -149,7 +148,7 @@
 		http.Error(w, "Method not allowed.", http.StatusMethodNotAllowed)
 		return
 	}
-	vlog.VI(0).Info("Creating a new websocket")
+	wspr.ctx.VI(0).Info("Creating a new websocket")
 	p := newPipe(w, r, wspr, nil)
 
 	if p == nil {