diff --git a/PRESUBMIT.cfg b/PRESUBMIT.cfg
index cb208f9..be13e21 100644
--- a/PRESUBMIT.cfg
+++ b/PRESUBMIT.cfg
@@ -3,8 +3,9 @@
 
 [Hook Overrides]
 cros_license_check: true
-# The only Golang code here is from protoc.
-gofmt_check: false
+# Must set to (the default) true, so that options below take effect.
+gofmt_check: true
 
 [Hook Overrides Options]
 cros_license_check: --exclude_regex=recipes/recipes\.py$
+gofmt_check: --exclude_regex=.*\.pb\.go$
diff --git a/PRESUBMIT.py b/PRESUBMIT.py
index 2ab3d3c..28c1f8e 100644
--- a/PRESUBMIT.py
+++ b/PRESUBMIT.py
@@ -12,7 +12,7 @@
 def CheckGenerated(input_api, output_api):
   results = []
   input_api.subprocess.call(
-      ['bash', './generate.sh'],
+      ['./generate.sh'],
       stdout=input_api.subprocess.PIPE,
       stderr=input_api.subprocess.PIPE)
   if _HasLocalChanges(input_api):
@@ -21,8 +21,25 @@
     results.append(output_api.PresubmitError(msg))
   return results
 
+def CheckExamples(input_api, output_api):
+  results = []
+  ret = input_api.subprocess.call(
+      ['./check_examples.sh'],
+      stdout=input_api.subprocess.PIPE,
+      stderr=input_api.subprocess.PIPE)
+  if ret:
+    results.append(output_api.PresubmitError(
+      'go test failed. Please run check_examples.sh for details.'))
+  return results
+
 def CheckChangeOnUpload(input_api, output_api):
-  return CheckGenerated(input_api, output_api)
+  results = []
+  results.extend(CheckGenerated(input_api, output_api))
+  results.extend(CheckExamples(input_api, output_api))
+  return results
 
 def CheckChangeOnCommit(input_api, output_api):
-  return CheckGenerated(input_api, output_api)
+  results = []
+  results.extend(CheckGenerated(input_api, output_api))
+  results.extend(CheckExamples(input_api, output_api))
+  return results
diff --git a/check_examples.sh b/check_examples.sh
new file mode 100755
index 0000000..e1e8a1f
--- /dev/null
+++ b/check_examples.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+#
+# Copyright 2020 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# Runs go test on all of the packages to validate the example code.
+# This script sets up the right Go toolchain and blacklists failing packages.
+set -eu
+
+# Blacklisted packages.
+# These are known to fail, e.g., from import loops.
+declare -A bad_packages
+# TODO(crbug.com/1062830): Fix the errors so we can remove blacklist
+bad_packages["prototype"]=1
+
+readonly script_dir="$(dirname "$(realpath -e "${BASH_SOURCE[0]}")")"
+source "${script_dir}/setup_cipd.sh"
+
+cd go || { echo "failed to cd into go"; exit 1; }
+packages=()
+for pkg in *; do
+    if ! [[ -d $pkg ]]; then
+        continue
+    fi
+    if [[ ${bad_packages[$pkg]:+1} = 1 ]]; then
+        continue
+    fi
+    packages+=("./${pkg}/...")
+done
+
+go test -mod=readonly "${packages[@]}"
diff --git a/generate.sh b/generate.sh
index dda225f..757c187 100755
--- a/generate.sh
+++ b/generate.sh
@@ -8,11 +8,8 @@
 
 CROS_CONFIG_REPO="https://chromium.googlesource.com/chromiumos/config"
 
-# Versions of packages to get from CIPD.
-CIPD_PROTOC_VERSION='v3.6.1'
-CIPD_PROTOC_GEN_GO_VERSION='v1.3.2'
-
 readonly script_dir="$(dirname "$(realpath -e "${BASH_SOURCE[0]}")")"
+source "${script_dir}/setup_cipd.sh"
 
 readonly work_dir=$(mktemp --tmpdir -d genprotoXXXXXX)
 trap "rm -rf ${work_dir}" EXIT
@@ -29,19 +26,6 @@
 fi
 readonly cros_config_subdir="config/proto"
 
-# Get protobuf compiler from CIPD.
-readonly cipd_root="${script_dir}/.cipd_bin"
-cipd ensure \
-  -log-level warning \
-  -root "${cipd_root}" \
-  -ensure-file - \
-  <<ENSURE_FILE
-infra/tools/protoc/\${platform} protobuf_version:${CIPD_PROTOC_VERSION}
-chromiumos/infra/tools/protoc-gen-go version:${CIPD_PROTOC_GEN_GO_VERSION}
-ENSURE_FILE
-
-PATH="${cipd_root}:${PATH}"
-
 cd "${script_dir}"
 
 echo "Generating go bindings..."
diff --git a/go/README b/go/README
index 0e0f15c..eaef75c 100644
--- a/go/README
+++ b/go/README
@@ -1 +1 @@
-This directory contains generated Go source.
+This directory contains generated Go source and examples.
diff --git a/go/go.mod b/go/go.mod
index 85e750f..0db6b2a 100644
--- a/go/go.mod
+++ b/go/go.mod
@@ -4,7 +4,7 @@
 
 require (
 	github.com/golang/protobuf v1.3.3
-	go.chromium.org/chromiumos/config/go v0.0.0-20200406184215-883fa04fe1ce
+	go.chromium.org/chromiumos/config/go v0.0.0-20200414232608-f5f458358927
 	google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55
 	google.golang.org/grpc v1.27.0
 )
diff --git a/go/go.sum b/go/go.sum
index bd2076b..a9e867e 100644
--- a/go/go.sum
+++ b/go/go.sum
@@ -14,8 +14,11 @@
 github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+go.chromium.org/chromiumos/config v0.0.0-20200414232608-f5f458358927 h1:mrjEAAToCB8pa3IV5j+zKluVLejafg2TeVmE3xU6Xsg=
 go.chromium.org/chromiumos/config/go v0.0.0-20200406184215-883fa04fe1ce h1:D5LCCREbTkSLXZNnmzk4HJvJbkngOmsu4uiWjsE9SKY=
 go.chromium.org/chromiumos/config/go v0.0.0-20200406184215-883fa04fe1ce/go.mod h1:CF3tnR4iHZNHapiBgHcI/QonygXaxUPNc3r4n7dz4wg=
+go.chromium.org/chromiumos/config/go v0.0.0-20200414232608-f5f458358927 h1:d75VDJNaWW+Iu/r67VDIcjWfrYVQrzLUAM1bUXKO8BM=
+go.chromium.org/chromiumos/config/go v0.0.0-20200414232608-f5f458358927/go.mod h1:CF3tnR4iHZNHapiBgHcI/QonygXaxUPNc3r4n7dz4wg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
diff --git a/go/tls/common.pb.go b/go/tls/common.pb.go
index e99f59f..6ac3f95 100644
--- a/go/tls/common.pb.go
+++ b/go/tls/common.pb.go
@@ -24,146 +24,315 @@
 // proto package needs to be updated.
 const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
 
-type DutShellRequest struct {
-	// dut is some identifier for the DUT.  This could be the DUT
-	// hostname, but the caller shouldn't know or care whether this is a
-	// hostname or not, as they would not be able to use the hostname to
-	// SSH or otherwise interact with the DUT directly.
-	Dut                  string   `protobuf:"bytes,1,opt,name=dut,proto3" json:"dut,omitempty"`
-	Command              string   `protobuf:"bytes,2,opt,name=command,proto3" json:"command,omitempty"`
+// Output enumeration for ExecDutCommandRequest.
+type Output int32
+
+const (
+	// OUTPUT_PIPE means to collect output and return it.
+	Output_OUTPUT_PIPE Output = 0
+	// OUTPUT_STDOUT is a special value for stderr which means to merge stderr into stdout.
+	Output_OUTPUT_STDOUT Output = 1
+)
+
+var Output_name = map[int32]string{
+	0: "OUTPUT_PIPE",
+	1: "OUTPUT_STDOUT",
+}
+
+var Output_value = map[string]int32{
+	"OUTPUT_PIPE":   0,
+	"OUTPUT_STDOUT": 1,
+}
+
+func (x Output) String() string {
+	return proto.EnumName(Output_name, int32(x))
+}
+
+func (Output) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_3b853cac387a48f4, []int{0}
+}
+
+type ExecDutCommandRequest struct {
+	// name is the resource name for the DUT.
+	// The DUT name is passed to the RTD when the RTD is started.
+	// It is not specified whether the name is the DUT hostname.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// command is the command to run.
+	// If this contains no slashes, it is resolved using PATH.
+	// If this starts with /, it is used as an absolute path to the
+	// program to run.
+	// Otherwise, this is treated as a path relative to the working
+	// directory.
+	Command string `protobuf:"bytes,2,opt,name=command,proto3" json:"command,omitempty"`
+	// args are the arguments to pass to the command.
+	Args []string `protobuf:"bytes,3,rep,name=args,proto3" json:"args,omitempty"`
+	// stdin is passed to the command as the program's stdin.
+	// The stream does not support seeking.
+	// An empty bytes is not treated specially; if the command reads
+	// from stdin, it will receive zero bytes.
+	Stdin []byte `protobuf:"bytes,4,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	// stdout indicates how to handle the command's stdout.
+	Stdout Output `protobuf:"varint,5,opt,name=stdout,proto3,enum=tls.Output" json:"stdout,omitempty"`
+	// stderr indicates how to handle the command's stderr.
+	Stderr               Output   `protobuf:"varint,6,opt,name=stderr,proto3,enum=tls.Output" json:"stderr,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *DutShellRequest) Reset()         { *m = DutShellRequest{} }
-func (m *DutShellRequest) String() string { return proto.CompactTextString(m) }
-func (*DutShellRequest) ProtoMessage()    {}
-func (*DutShellRequest) Descriptor() ([]byte, []int) {
+func (m *ExecDutCommandRequest) Reset()         { *m = ExecDutCommandRequest{} }
+func (m *ExecDutCommandRequest) String() string { return proto.CompactTextString(m) }
+func (*ExecDutCommandRequest) ProtoMessage()    {}
+func (*ExecDutCommandRequest) Descriptor() ([]byte, []int) {
 	return fileDescriptor_3b853cac387a48f4, []int{0}
 }
 
-func (m *DutShellRequest) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_DutShellRequest.Unmarshal(m, b)
+func (m *ExecDutCommandRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ExecDutCommandRequest.Unmarshal(m, b)
 }
-func (m *DutShellRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_DutShellRequest.Marshal(b, m, deterministic)
+func (m *ExecDutCommandRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ExecDutCommandRequest.Marshal(b, m, deterministic)
 }
-func (m *DutShellRequest) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_DutShellRequest.Merge(m, src)
+func (m *ExecDutCommandRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ExecDutCommandRequest.Merge(m, src)
 }
-func (m *DutShellRequest) XXX_Size() int {
-	return xxx_messageInfo_DutShellRequest.Size(m)
+func (m *ExecDutCommandRequest) XXX_Size() int {
+	return xxx_messageInfo_ExecDutCommandRequest.Size(m)
 }
-func (m *DutShellRequest) XXX_DiscardUnknown() {
-	xxx_messageInfo_DutShellRequest.DiscardUnknown(m)
+func (m *ExecDutCommandRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ExecDutCommandRequest.DiscardUnknown(m)
 }
 
-var xxx_messageInfo_DutShellRequest proto.InternalMessageInfo
+var xxx_messageInfo_ExecDutCommandRequest proto.InternalMessageInfo
 
-func (m *DutShellRequest) GetDut() string {
+func (m *ExecDutCommandRequest) GetName() string {
 	if m != nil {
-		return m.Dut
+		return m.Name
 	}
 	return ""
 }
 
-func (m *DutShellRequest) GetCommand() string {
+func (m *ExecDutCommandRequest) GetCommand() string {
 	if m != nil {
 		return m.Command
 	}
 	return ""
 }
 
-// For the last response in the stream, exited will be true and status
-// will be set.
-type DutShellResponse struct {
-	Status               int32    `protobuf:"varint,1,opt,name=status,proto3" json:"status,omitempty"`
-	Exited               bool     `protobuf:"varint,2,opt,name=exited,proto3" json:"exited,omitempty"`
-	Stdout               []byte   `protobuf:"bytes,3,opt,name=stdout,proto3" json:"stdout,omitempty"`
-	Stderr               []byte   `protobuf:"bytes,4,opt,name=stderr,proto3" json:"stderr,omitempty"`
+func (m *ExecDutCommandRequest) GetArgs() []string {
+	if m != nil {
+		return m.Args
+	}
+	return nil
+}
+
+func (m *ExecDutCommandRequest) GetStdin() []byte {
+	if m != nil {
+		return m.Stdin
+	}
+	return nil
+}
+
+func (m *ExecDutCommandRequest) GetStdout() Output {
+	if m != nil {
+		return m.Stdout
+	}
+	return Output_OUTPUT_PIPE
+}
+
+func (m *ExecDutCommandRequest) GetStderr() Output {
+	if m != nil {
+		return m.Stderr
+	}
+	return Output_OUTPUT_PIPE
+}
+
+type ExecDutCommandResponse struct {
+	// exit_info contains exit information.
+	// This is set when the command has exited or failed to start.
+	// This is set on the last message in the response stream.
+	ExitInfo *ExecDutCommandResponse_ExitInfo `protobuf:"bytes,1,opt,name=exit_info,json=exitInfo,proto3" json:"exit_info,omitempty"`
+	// stdout contains the shell command's stdout output since the last
+	// response in the stream.
+	// The implementation MAY batch or delay output to later
+	// responses in the stream.
+	Stdout []byte `protobuf:"bytes,2,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	// stderr contains the shell command's stderr output since the last
+	// response in the stream.
+	// The implementation MAY batch or delay output to later
+	// responses in the stream.
+	Stderr               []byte   `protobuf:"bytes,3,opt,name=stderr,proto3" json:"stderr,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *DutShellResponse) Reset()         { *m = DutShellResponse{} }
-func (m *DutShellResponse) String() string { return proto.CompactTextString(m) }
-func (*DutShellResponse) ProtoMessage()    {}
-func (*DutShellResponse) Descriptor() ([]byte, []int) {
+func (m *ExecDutCommandResponse) Reset()         { *m = ExecDutCommandResponse{} }
+func (m *ExecDutCommandResponse) String() string { return proto.CompactTextString(m) }
+func (*ExecDutCommandResponse) ProtoMessage()    {}
+func (*ExecDutCommandResponse) Descriptor() ([]byte, []int) {
 	return fileDescriptor_3b853cac387a48f4, []int{1}
 }
 
-func (m *DutShellResponse) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_DutShellResponse.Unmarshal(m, b)
+func (m *ExecDutCommandResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ExecDutCommandResponse.Unmarshal(m, b)
 }
-func (m *DutShellResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_DutShellResponse.Marshal(b, m, deterministic)
+func (m *ExecDutCommandResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ExecDutCommandResponse.Marshal(b, m, deterministic)
 }
-func (m *DutShellResponse) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_DutShellResponse.Merge(m, src)
+func (m *ExecDutCommandResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ExecDutCommandResponse.Merge(m, src)
 }
-func (m *DutShellResponse) XXX_Size() int {
-	return xxx_messageInfo_DutShellResponse.Size(m)
+func (m *ExecDutCommandResponse) XXX_Size() int {
+	return xxx_messageInfo_ExecDutCommandResponse.Size(m)
 }
-func (m *DutShellResponse) XXX_DiscardUnknown() {
-	xxx_messageInfo_DutShellResponse.DiscardUnknown(m)
+func (m *ExecDutCommandResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ExecDutCommandResponse.DiscardUnknown(m)
 }
 
-var xxx_messageInfo_DutShellResponse proto.InternalMessageInfo
+var xxx_messageInfo_ExecDutCommandResponse proto.InternalMessageInfo
 
-func (m *DutShellResponse) GetStatus() int32 {
+func (m *ExecDutCommandResponse) GetExitInfo() *ExecDutCommandResponse_ExitInfo {
 	if m != nil {
-		return m.Status
+		return m.ExitInfo
 	}
-	return 0
+	return nil
 }
 
-func (m *DutShellResponse) GetExited() bool {
-	if m != nil {
-		return m.Exited
-	}
-	return false
-}
-
-func (m *DutShellResponse) GetStdout() []byte {
+func (m *ExecDutCommandResponse) GetStdout() []byte {
 	if m != nil {
 		return m.Stdout
 	}
 	return nil
 }
 
-func (m *DutShellResponse) GetStderr() []byte {
+func (m *ExecDutCommandResponse) GetStderr() []byte {
 	if m != nil {
 		return m.Stderr
 	}
 	return nil
 }
 
+type ExecDutCommandResponse_ExitInfo struct {
+	// status provides information about how the command process
+	// terminated.
+	//
+	// If the command failed to start, status is set to an arbitrary
+	// non-zero value.
+	//
+	// If signaled is set, status is set to the signal that caused
+	// the command to terminate.
+	//
+	// Otherwise, status is set to the exit status of the process.
+	// Exit statuses outside of 0 to 255 inclusive are not supported;
+	// they will be mapped to an arbitrary non-zero value.
+	//
+	// status is zero if and only if the process was successfully
+	// started and exited with a zero status.
+	Status int32 `protobuf:"varint,1,opt,name=status,proto3" json:"status,omitempty"`
+	// signaled indicates whether the command exited due to a signal.
+	// If set, status contains the signal.
+	Signaled bool `protobuf:"varint,2,opt,name=signaled,proto3" json:"signaled,omitempty"`
+	// started indicates whether the command was started.
+	Started bool `protobuf:"varint,3,opt,name=started,proto3" json:"started,omitempty"`
+	// error_message provides a human readable explanation for some errors.
+	// This MUST NOT be inspected by programs.
+	ErrorMessage         string   `protobuf:"bytes,4,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ExecDutCommandResponse_ExitInfo) Reset()         { *m = ExecDutCommandResponse_ExitInfo{} }
+func (m *ExecDutCommandResponse_ExitInfo) String() string { return proto.CompactTextString(m) }
+func (*ExecDutCommandResponse_ExitInfo) ProtoMessage()    {}
+func (*ExecDutCommandResponse_ExitInfo) Descriptor() ([]byte, []int) {
+	return fileDescriptor_3b853cac387a48f4, []int{1, 0}
+}
+
+func (m *ExecDutCommandResponse_ExitInfo) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ExecDutCommandResponse_ExitInfo.Unmarshal(m, b)
+}
+func (m *ExecDutCommandResponse_ExitInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ExecDutCommandResponse_ExitInfo.Marshal(b, m, deterministic)
+}
+func (m *ExecDutCommandResponse_ExitInfo) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ExecDutCommandResponse_ExitInfo.Merge(m, src)
+}
+func (m *ExecDutCommandResponse_ExitInfo) XXX_Size() int {
+	return xxx_messageInfo_ExecDutCommandResponse_ExitInfo.Size(m)
+}
+func (m *ExecDutCommandResponse_ExitInfo) XXX_DiscardUnknown() {
+	xxx_messageInfo_ExecDutCommandResponse_ExitInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ExecDutCommandResponse_ExitInfo proto.InternalMessageInfo
+
+func (m *ExecDutCommandResponse_ExitInfo) GetStatus() int32 {
+	if m != nil {
+		return m.Status
+	}
+	return 0
+}
+
+func (m *ExecDutCommandResponse_ExitInfo) GetSignaled() bool {
+	if m != nil {
+		return m.Signaled
+	}
+	return false
+}
+
+func (m *ExecDutCommandResponse_ExitInfo) GetStarted() bool {
+	if m != nil {
+		return m.Started
+	}
+	return false
+}
+
+func (m *ExecDutCommandResponse_ExitInfo) GetErrorMessage() string {
+	if m != nil {
+		return m.ErrorMessage
+	}
+	return ""
+}
+
 func init() {
-	proto.RegisterType((*DutShellRequest)(nil), "tls.DutShellRequest")
-	proto.RegisterType((*DutShellResponse)(nil), "tls.DutShellResponse")
+	proto.RegisterEnum("tls.Output", Output_name, Output_value)
+	proto.RegisterType((*ExecDutCommandRequest)(nil), "tls.ExecDutCommandRequest")
+	proto.RegisterType((*ExecDutCommandResponse)(nil), "tls.ExecDutCommandResponse")
+	proto.RegisterType((*ExecDutCommandResponse_ExitInfo)(nil), "tls.ExecDutCommandResponse.ExitInfo")
 }
 
 func init() { proto.RegisterFile("tls/common.proto", fileDescriptor_3b853cac387a48f4) }
 
 var fileDescriptor_3b853cac387a48f4 = []byte{
-	// 229 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x5c, 0x90, 0xc1, 0x4a, 0xc4, 0x30,
-	0x10, 0x86, 0xa9, 0xd5, 0xba, 0x06, 0xc1, 0x12, 0x54, 0x82, 0xa7, 0x65, 0x4f, 0x7b, 0x31, 0x11,
-	0x3d, 0x79, 0xf0, 0xe2, 0xfa, 0x04, 0xf1, 0xe6, 0xad, 0x6e, 0xc7, 0x6e, 0x21, 0xed, 0xac, 0x33,
-	0x13, 0xf0, 0xf1, 0xa5, 0x69, 0xab, 0xd0, 0x5b, 0xbe, 0x8f, 0xcc, 0x9f, 0xfc, 0xa3, 0x4a, 0x09,
-	0xec, 0xf6, 0xd8, 0x75, 0xd8, 0xdb, 0x23, 0xa1, 0xa0, 0xce, 0x25, 0xf0, 0xe6, 0x45, 0x5d, 0xbd,
-	0x45, 0x79, 0x3f, 0x40, 0x08, 0x1e, 0xbe, 0x23, 0xb0, 0xe8, 0x52, 0xe5, 0x75, 0x14, 0x93, 0xad,
-	0xb3, 0xed, 0x85, 0x1f, 0x8e, 0xda, 0xa8, 0xf3, 0x61, 0xb2, 0xea, 0x6b, 0x73, 0x92, 0xec, 0x8c,
-	0x1b, 0x52, 0xe5, 0xff, 0x38, 0x1f, 0xb1, 0x67, 0xd0, 0xb7, 0xaa, 0x60, 0xa9, 0x24, 0x72, 0x8a,
-	0x38, 0xf3, 0x13, 0x0d, 0x1e, 0x7e, 0x5a, 0x81, 0x31, 0x64, 0xe5, 0x27, 0x1a, 0xef, 0xd7, 0x18,
-	0xc5, 0xe4, 0xeb, 0x6c, 0x7b, 0xe9, 0x27, 0x9a, 0x3c, 0x10, 0x99, 0xd3, 0x3f, 0x0f, 0x44, 0x8f,
-	0x3b, 0x55, 0xec, 0x52, 0x0f, 0xfd, 0xac, 0x56, 0xf3, 0xeb, 0xfa, 0xda, 0x4a, 0x60, 0xbb, 0xe8,
-	0x72, 0x77, 0xb3, 0xb0, 0xe3, 0x17, 0x1f, 0xb2, 0x57, 0xf7, 0x71, 0xdf, 0xa0, 0xdd, 0x1f, 0x08,
-	0xbb, 0x36, 0x76, 0x16, 0xa9, 0x71, 0x33, 0x20, 0xbb, 0xb6, 0xff, 0xa2, 0xca, 0xa5, 0x35, 0xb9,
-	0x06, 0x9d, 0x04, 0xfe, 0x2c, 0x12, 0x3d, 0xfd, 0x06, 0x00, 0x00, 0xff, 0xff, 0xf5, 0x6e, 0x53,
-	0x31, 0x48, 0x01, 0x00, 0x00,
+	// 403 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x92, 0xcf, 0x6e, 0xd3, 0x40,
+	0x10, 0xc6, 0x71, 0xd2, 0x18, 0x67, 0xd2, 0x96, 0xb0, 0x82, 0xc8, 0x0a, 0x97, 0xa8, 0xe5, 0x10,
+	0x21, 0xb0, 0x51, 0x78, 0x02, 0x68, 0x73, 0xa8, 0x10, 0x4a, 0xb4, 0xc4, 0x17, 0x2e, 0xd1, 0x62,
+	0x6f, 0x8c, 0x25, 0xef, 0x6e, 0xd8, 0x19, 0x4b, 0xb9, 0xf0, 0x02, 0xbc, 0x11, 0x6f, 0x87, 0xbc,
+	0xfe, 0x23, 0x15, 0x45, 0xdc, 0xe6, 0xfb, 0xfc, 0x79, 0xfc, 0xf9, 0xa7, 0x81, 0x29, 0x95, 0x18,
+	0xa7, 0x46, 0x29, 0xa3, 0xa3, 0xa3, 0x35, 0x64, 0xd8, 0x90, 0x4a, 0xbc, 0xf9, 0xe3, 0xc1, 0xcb,
+	0xf5, 0x49, 0xa6, 0xf7, 0x15, 0xdd, 0x19, 0xa5, 0x84, 0xce, 0xb8, 0xfc, 0x59, 0x49, 0x24, 0xc6,
+	0xe0, 0x42, 0x0b, 0x25, 0x43, 0x6f, 0xe1, 0x2d, 0xc7, 0xdc, 0xcd, 0x2c, 0x84, 0xa7, 0x69, 0x93,
+	0x0a, 0x07, 0xce, 0xee, 0x64, 0x9d, 0x16, 0x36, 0xc7, 0x70, 0xb8, 0x18, 0xd6, 0xe9, 0x7a, 0x66,
+	0x2f, 0x60, 0x84, 0x94, 0x15, 0x3a, 0xbc, 0x58, 0x78, 0xcb, 0x4b, 0xde, 0x08, 0x76, 0x0b, 0x3e,
+	0x52, 0x66, 0x2a, 0x0a, 0x47, 0x0b, 0x6f, 0x79, 0xbd, 0x9a, 0x44, 0x54, 0x62, 0xb4, 0xa9, 0xe8,
+	0x58, 0x11, 0x6f, 0x1f, 0xb5, 0x21, 0x69, 0x6d, 0xe8, 0x9f, 0x0f, 0x49, 0x6b, 0x6f, 0x7e, 0x0f,
+	0x60, 0xf6, 0x6f, 0x77, 0x3c, 0x1a, 0x8d, 0x92, 0x7d, 0x84, 0xb1, 0x3c, 0x15, 0xb4, 0x2f, 0xf4,
+	0xc1, 0xb8, 0x3f, 0x98, 0xac, 0x5e, 0xbb, 0x15, 0xe7, 0xf3, 0xd1, 0xfa, 0x54, 0xd0, 0x83, 0x3e,
+	0x18, 0x1e, 0xc8, 0x76, 0x62, 0xb3, 0xbe, 0xe7, 0xc0, 0xd5, 0xef, 0xaa, 0xcd, 0xfa, 0x6a, 0xc3,
+	0xde, 0x97, 0xd6, 0xce, 0x7f, 0x41, 0xb0, 0x7e, 0xf4, 0xae, 0xa0, 0x0a, 0xdd, 0xb7, 0x47, 0xbc,
+	0x55, 0x6c, 0x0e, 0x01, 0x16, 0xb9, 0x16, 0xa5, 0x6c, 0x00, 0x06, 0xbc, 0xd7, 0x35, 0x5b, 0x24,
+	0x61, 0x49, 0x66, 0x6e, 0x71, 0xc0, 0x3b, 0xc9, 0x6e, 0xe1, 0x4a, 0x5a, 0x6b, 0xec, 0x5e, 0x49,
+	0x44, 0x91, 0x4b, 0xc7, 0x73, 0xcc, 0x2f, 0x9d, 0xf9, 0xa5, 0xf1, 0xde, 0xbc, 0x05, 0xbf, 0xc1,
+	0xc3, 0x9e, 0xc1, 0x64, 0x93, 0xec, 0xb6, 0xc9, 0x6e, 0xbf, 0x7d, 0xd8, 0xae, 0xa7, 0x4f, 0xd8,
+	0x73, 0xb8, 0x6a, 0x8d, 0xaf, 0xbb, 0xfb, 0x4d, 0xb2, 0x9b, 0x7a, 0xab, 0x04, 0xfc, 0x3b, 0x77,
+	0x0b, 0xec, 0x33, 0x5c, 0x3f, 0x66, 0xc2, 0xe6, 0x67, 0x41, 0xb9, 0xa3, 0x98, 0xbf, 0xfa, 0x0f,
+	0xc4, 0xf7, 0xde, 0xa7, 0xf8, 0xdb, 0xbb, 0xdc, 0x44, 0xe9, 0x0f, 0x6b, 0x54, 0x51, 0xa9, 0xc8,
+	0xd8, 0x3c, 0xee, 0x84, 0xc1, 0xb8, 0xd0, 0x07, 0x2b, 0x62, 0x77, 0x7c, 0x71, 0x6e, 0x62, 0x2a,
+	0xf1, 0xbb, 0xef, 0xd4, 0x87, 0xbf, 0x01, 0x00, 0x00, 0xff, 0xff, 0xe5, 0xaa, 0xda, 0x5f, 0x9e,
+	0x02, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -178,9 +347,28 @@
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
 type CommonClient interface {
-	// Runs a shell command with the default shell.
-	// Does not spawn a tty.
-	DutShell(ctx context.Context, in *DutShellRequest, opts ...grpc.CallOption) (Common_DutShellClient, error)
+	// ExecDutCommand runs a command on a DUT.
+	//
+	// The working directory is /.
+	// A tty is not spawned for the command.
+	// The user and group is root.
+	// All signals have their default dispositions and are not masked.
+	// The umask is set to 0.
+	//
+	// The environment contains:
+	//
+	//   TERM=dumb
+	//   PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin
+	//   LANG=en_US.UTF-8
+	//   USER=root
+	//   HOME=/root
+	//
+	// The environment MAY also contain SSH client variables.
+	// The environment SHALL NOT contain variables not mentioned above.
+	//
+	// If the stream is interrupted, the implementation MAY attempt to
+	// stop the command by sending SIGINT, SIGHUP, SIGTERM, or SIGKILL.
+	ExecDutCommand(ctx context.Context, in *ExecDutCommandRequest, opts ...grpc.CallOption) (Common_ExecDutCommandClient, error)
 }
 
 type commonClient struct {
@@ -191,12 +379,12 @@
 	return &commonClient{cc}
 }
 
-func (c *commonClient) DutShell(ctx context.Context, in *DutShellRequest, opts ...grpc.CallOption) (Common_DutShellClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Common_serviceDesc.Streams[0], "/tls.Common/DutShell", opts...)
+func (c *commonClient) ExecDutCommand(ctx context.Context, in *ExecDutCommandRequest, opts ...grpc.CallOption) (Common_ExecDutCommandClient, error) {
+	stream, err := c.cc.NewStream(ctx, &_Common_serviceDesc.Streams[0], "/tls.Common/ExecDutCommand", opts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &commonDutShellClient{stream}
+	x := &commonExecDutCommandClient{stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -206,17 +394,17 @@
 	return x, nil
 }
 
-type Common_DutShellClient interface {
-	Recv() (*DutShellResponse, error)
+type Common_ExecDutCommandClient interface {
+	Recv() (*ExecDutCommandResponse, error)
 	grpc.ClientStream
 }
 
-type commonDutShellClient struct {
+type commonExecDutCommandClient struct {
 	grpc.ClientStream
 }
 
-func (x *commonDutShellClient) Recv() (*DutShellResponse, error) {
-	m := new(DutShellResponse)
+func (x *commonExecDutCommandClient) Recv() (*ExecDutCommandResponse, error) {
+	m := new(ExecDutCommandResponse)
 	if err := x.ClientStream.RecvMsg(m); err != nil {
 		return nil, err
 	}
@@ -225,41 +413,60 @@
 
 // CommonServer is the server API for Common service.
 type CommonServer interface {
-	// Runs a shell command with the default shell.
-	// Does not spawn a tty.
-	DutShell(*DutShellRequest, Common_DutShellServer) error
+	// ExecDutCommand runs a command on a DUT.
+	//
+	// The working directory is /.
+	// A tty is not spawned for the command.
+	// The user and group is root.
+	// All signals have their default dispositions and are not masked.
+	// The umask is set to 0.
+	//
+	// The environment contains:
+	//
+	//   TERM=dumb
+	//   PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin
+	//   LANG=en_US.UTF-8
+	//   USER=root
+	//   HOME=/root
+	//
+	// The environment MAY also contain SSH client variables.
+	// The environment SHALL NOT contain variables not mentioned above.
+	//
+	// If the stream is interrupted, the implementation MAY attempt to
+	// stop the command by sending SIGINT, SIGHUP, SIGTERM, or SIGKILL.
+	ExecDutCommand(*ExecDutCommandRequest, Common_ExecDutCommandServer) error
 }
 
 // UnimplementedCommonServer can be embedded to have forward compatible implementations.
 type UnimplementedCommonServer struct {
 }
 
-func (*UnimplementedCommonServer) DutShell(req *DutShellRequest, srv Common_DutShellServer) error {
-	return status.Errorf(codes.Unimplemented, "method DutShell not implemented")
+func (*UnimplementedCommonServer) ExecDutCommand(req *ExecDutCommandRequest, srv Common_ExecDutCommandServer) error {
+	return status.Errorf(codes.Unimplemented, "method ExecDutCommand not implemented")
 }
 
 func RegisterCommonServer(s *grpc.Server, srv CommonServer) {
 	s.RegisterService(&_Common_serviceDesc, srv)
 }
 
-func _Common_DutShell_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(DutShellRequest)
+func _Common_ExecDutCommand_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(ExecDutCommandRequest)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(CommonServer).DutShell(m, &commonDutShellServer{stream})
+	return srv.(CommonServer).ExecDutCommand(m, &commonExecDutCommandServer{stream})
 }
 
-type Common_DutShellServer interface {
-	Send(*DutShellResponse) error
+type Common_ExecDutCommandServer interface {
+	Send(*ExecDutCommandResponse) error
 	grpc.ServerStream
 }
 
-type commonDutShellServer struct {
+type commonExecDutCommandServer struct {
 	grpc.ServerStream
 }
 
-func (x *commonDutShellServer) Send(m *DutShellResponse) error {
+func (x *commonExecDutCommandServer) Send(m *ExecDutCommandResponse) error {
 	return x.ServerStream.SendMsg(m)
 }
 
@@ -269,8 +476,8 @@
 	Methods:     []grpc.MethodDesc{},
 	Streams: []grpc.StreamDesc{
 		{
-			StreamName:    "DutShell",
-			Handler:       _Common_DutShell_Handler,
+			StreamName:    "ExecDutCommand",
+			Handler:       _Common_ExecDutCommand_Handler,
 			ServerStreams: true,
 		},
 	},
diff --git a/go/tls/example_test.go b/go/tls/example_test.go
new file mode 100644
index 0000000..5d15887
--- /dev/null
+++ b/go/tls/example_test.go
@@ -0,0 +1,113 @@
+package tls_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+
+	"go.chromium.org/chromiumos/infra/proto/go/tls"
+	"google.golang.org/grpc"
+)
+
+func ExampleCommonClient_ExecDutCommand() {
+	// The RTD will receive this in its invocation spec.
+	var (
+		addr    string
+		dutName string
+	)
+	conn, err := grpc.Dial(addr)
+	if err != nil {
+		panic(err)
+	}
+	defer conn.Close()
+	c := tls.NewCommonClient(conn)
+	ctx := context.Background()
+	req := tls.ExecDutCommandRequest{
+		Name:    dutName,
+		Command: "echo",
+		Args:    []string{"hello world"},
+	}
+	stream, err := c.ExecDutCommand(ctx, &req)
+	if err != nil {
+		panic("RPC error")
+	}
+	// Handle stream in various ways.
+	_ = stream
+}
+
+func ExampleCommonClient_ExecDutCommand_CheckSuccess() {
+	// stream from ExecDutCommand,
+	// See example for CommonClient.ExecDutCommand.
+	var stream tls.Common_ExecDutCommandClient
+	var exitInfo *tls.ExecDutCommandResponse_ExitInfo
+readStream:
+	for {
+		resp, err := stream.Recv()
+		switch err {
+		case nil:
+			if v := resp.GetExitInfo(); v != nil {
+				exitInfo = v
+			}
+		case io.EOF:
+			break readStream
+		default:
+			panic("RPC error")
+		}
+	}
+	if exitInfo.GetStatus() != 0 {
+		panic("command failed")
+	}
+}
+
+func ExampleCommonClient_ExecDutCommand_CheckSpecificStatus() {
+	// stream from ExecDutCommand,
+	// See example for CommonClient.ExecDutCommand.
+	var stream tls.Common_ExecDutCommandClient
+	var exitInfo *tls.ExecDutCommandResponse_ExitInfo
+readStream:
+	for {
+		resp, err := stream.Recv()
+		switch err {
+		case nil:
+			if v := resp.GetExitInfo(); v != nil {
+				exitInfo = v
+			}
+		case io.EOF:
+			break readStream
+		default:
+			panic("RPC error")
+		}
+	}
+	switch {
+	case !exitInfo.GetStarted():
+		fmt.Printf("process not started: %v", exitInfo.GetErrorMessage())
+	case exitInfo.GetSignaled():
+		fmt.Printf("process received signal %v", exitInfo.GetStatus())
+	default:
+		fmt.Printf("process exited with %v", exitInfo.GetStatus())
+	}
+}
+
+func ExampleCommonClient_ExecDutCommand_ReadOutput() {
+	// Stream from ExecDutCommand.
+	// See example for CommonClient.ExecDutCommand.
+	var stream tls.Common_ExecDutCommandClient
+	var (
+		stdout bytes.Buffer
+		stderr bytes.Buffer
+	)
+readStream:
+	for {
+		resp, err := stream.Recv()
+		switch err {
+		case nil:
+			stdout.Write(resp.Stdout)
+			stderr.Write(resp.Stderr)
+		case io.EOF:
+			break readStream
+		default:
+			panic("RPC error")
+		}
+	}
+}
diff --git a/go/tls/wiring.pb.go b/go/tls/wiring.pb.go
index bc33958..0ee3bdf 100644
--- a/go/tls/wiring.pb.go
+++ b/go/tls/wiring.pb.go
@@ -25,41 +25,6 @@
 // proto package needs to be updated.
 const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
 
-type OpenDutPortResponse_Status int32
-
-const (
-	OpenDutPortResponse_STATUS_UNKNOWN OpenDutPortResponse_Status = 0
-	OpenDutPortResponse_STATUS_OK      OpenDutPortResponse_Status = 1
-	// STATUS_BAD_DUT indicates that the DUT is not known,
-	// or the caller does not have access to it.
-	OpenDutPortResponse_STATUS_BAD_DUT OpenDutPortResponse_Status = 2
-	// STATUS_DUT_UNREACHABLE indicates that the DUT is not reachable
-	// over the network.
-	OpenDutPortResponse_STATUS_DUT_UNREACHABLE OpenDutPortResponse_Status = 3
-)
-
-var OpenDutPortResponse_Status_name = map[int32]string{
-	0: "STATUS_UNKNOWN",
-	1: "STATUS_OK",
-	2: "STATUS_BAD_DUT",
-	3: "STATUS_DUT_UNREACHABLE",
-}
-
-var OpenDutPortResponse_Status_value = map[string]int32{
-	"STATUS_UNKNOWN":         0,
-	"STATUS_OK":              1,
-	"STATUS_BAD_DUT":         2,
-	"STATUS_DUT_UNREACHABLE": 3,
-}
-
-func (x OpenDutPortResponse_Status) String() string {
-	return proto.EnumName(OpenDutPortResponse_Status_name, int32(x))
-}
-
-func (OpenDutPortResponse_Status) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_aaa1c187e104f1c4, []int{1, 0}
-}
-
 type SetDutPowerSupplyRequest_State int32
 
 const (
@@ -205,14 +170,12 @@
 }
 
 type OpenDutPortRequest struct {
-	// dut is some identifier for the DUT.
-	// The DUT ID is passed to the RTD when it is started.
-	// This could be the DUT hostname, but the caller should not be able
-	// to use the hostname to SSH or otherwise interact with the DUT
-	// directly.
-	Dut string `protobuf:"bytes,1,opt,name=dut,proto3" json:"dut,omitempty"`
-	// Port to open on the DUT.
-	DutPort              int32    `protobuf:"varint,2,opt,name=dut_port,json=dutPort,proto3" json:"dut_port,omitempty"`
+	// name is the resource name for the DUT.
+	// The DUT name is passed to the RTD when the RTD is started.
+	// It is not specified whether the name is the DUT hostname.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// port is the port to open on the DUT.
+	Port                 int32    `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -243,29 +206,33 @@
 
 var xxx_messageInfo_OpenDutPortRequest proto.InternalMessageInfo
 
-func (m *OpenDutPortRequest) GetDut() string {
+func (m *OpenDutPortRequest) GetName() string {
 	if m != nil {
-		return m.Dut
+		return m.Name
 	}
 	return ""
 }
 
-func (m *OpenDutPortRequest) GetDutPort() int32 {
+func (m *OpenDutPortRequest) GetPort() int32 {
 	if m != nil {
-		return m.DutPort
+		return m.Port
 	}
 	return 0
 }
 
 type OpenDutPortResponse struct {
-	Status OpenDutPortResponse_Status `protobuf:"varint,1,opt,name=status,proto3,enum=tls.OpenDutPortResponse_Status" json:"status,omitempty"`
-	// address which is forwarded to the DUT, in the form host:port.
-	// TLEs should return an IP address to avoid name resolution issues.
-	// If TLEs return a hostname, they should ensure that the hostname is
-	// resolveable by the RTD via standard name resolution facilities.
-	Address string `protobuf:"bytes,2,opt,name=address,proto3" json:"address,omitempty"`
-	// reason provides human friendly context for any error status.
-	Reason               string   `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
+	// address for which a port is forwarded to the DUT.
+	// TLEs SHOULD return an IPv4 or IPv6 address to avoid name
+	// resolution issues.
+	// IPv4 addresses MUST be in standard dotted decimal notation.
+	// IPv6 addresses MUST be formatted according to RFC4291, Section
+	// 2.2.  The mixed IPv4 and IPv6 form MUST NOT be used.
+	// If TLEs return a hostname, they SHOULD ensure that the hostname
+	// can be resolved by the RTD via standard name resolution
+	// facilities.
+	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+	// port on the address which is forwarded to the DUT.
+	Port                 int32    `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -296,13 +263,6 @@
 
 var xxx_messageInfo_OpenDutPortResponse proto.InternalMessageInfo
 
-func (m *OpenDutPortResponse) GetStatus() OpenDutPortResponse_Status {
-	if m != nil {
-		return m.Status
-	}
-	return OpenDutPortResponse_STATUS_UNKNOWN
-}
-
 func (m *OpenDutPortResponse) GetAddress() string {
 	if m != nil {
 		return m.Address
@@ -310,11 +270,11 @@
 	return ""
 }
 
-func (m *OpenDutPortResponse) GetReason() string {
+func (m *OpenDutPortResponse) GetPort() int32 {
 	if m != nil {
-		return m.Reason
+		return m.Port
 	}
-	return ""
+	return 0
 }
 
 type SetDutPowerSupplyRequest struct {
@@ -626,7 +586,6 @@
 }
 
 func init() {
-	proto.RegisterEnum("tls.OpenDutPortResponse_Status", OpenDutPortResponse_Status_name, OpenDutPortResponse_Status_value)
 	proto.RegisterEnum("tls.SetDutPowerSupplyRequest_State", SetDutPowerSupplyRequest_State_name, SetDutPowerSupplyRequest_State_value)
 	proto.RegisterEnum("tls.SetDutPowerSupplyResponse_Status", SetDutPowerSupplyResponse_Status_name, SetDutPowerSupplyResponse_Status_value)
 	proto.RegisterEnum("tls.CacheForDutResponse_Status", CacheForDutResponse_Status_name, CacheForDutResponse_Status_value)
@@ -644,53 +603,51 @@
 func init() { proto.RegisterFile("tls/wiring.proto", fileDescriptor_aaa1c187e104f1c4) }
 
 var fileDescriptor_aaa1c187e104f1c4 = []byte{
-	// 728 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x55, 0xdd, 0x4e, 0xdb, 0x48,
-	0x14, 0x5e, 0xdb, 0x49, 0x80, 0xc3, 0x02, 0xc3, 0x04, 0x85, 0x90, 0xfd, 0x63, 0x8d, 0x76, 0xc5,
-	0xcd, 0xc6, 0xab, 0xec, 0x05, 0x5a, 0x55, 0x95, 0x9a, 0x1f, 0x47, 0x20, 0x88, 0x4d, 0xc7, 0x36,
-	0x54, 0xed, 0x85, 0xe5, 0x26, 0x43, 0x48, 0xe5, 0xc4, 0xee, 0x78, 0x0c, 0xed, 0x5d, 0xd5, 0x87,
-	0xe8, 0x75, 0x1f, 0xa1, 0x2f, 0xd4, 0xbb, 0xbe, 0x42, 0xef, 0xab, 0x8c, 0x9d, 0x62, 0xf2, 0x27,
-	0x55, 0x5c, 0x25, 0xe7, 0xcc, 0x99, 0xf3, 0xf3, 0x7d, 0xdf, 0x1c, 0x03, 0xe2, 0x7e, 0xa4, 0xdd,
-	0x0e, 0xd8, 0x60, 0xd4, 0xaf, 0x86, 0x2c, 0xe0, 0x01, 0x56, 0xb8, 0x1f, 0x55, 0x8a, 0x6f, 0x86,
-	0x3e, 0x0b, 0xbb, 0x5a, 0xf2, 0x93, 0x9c, 0xa8, 0x75, 0xc0, 0x66, 0x48, 0x47, 0xad, 0x98, 0x9f,
-	0x07, 0x8c, 0x13, 0xfa, 0x3a, 0xa6, 0x11, 0xc7, 0x08, 0x94, 0x5e, 0xcc, 0xcb, 0xd2, 0xbe, 0x74,
-	0xb8, 0x46, 0xc6, 0x7f, 0xf1, 0x1e, 0xac, 0xf6, 0x62, 0xee, 0x86, 0x01, 0xe3, 0x65, 0x79, 0x5f,
-	0x3a, 0xcc, 0x93, 0x95, 0x5e, 0x72, 0x47, 0xfd, 0x2c, 0x41, 0xf1, 0x5e, 0x8e, 0x28, 0x0c, 0x46,
-	0x11, 0xc5, 0x47, 0x50, 0x88, 0xb8, 0xc7, 0xe3, 0x48, 0xe4, 0xd9, 0xac, 0xfd, 0x51, 0xe5, 0x7e,
-	0x54, 0x9d, 0x13, 0x59, 0xb5, 0x44, 0x18, 0x49, 0xc3, 0x71, 0x19, 0x56, 0xbc, 0x5e, 0x8f, 0xd1,
-	0x28, 0x12, 0xa5, 0xd6, 0xc8, 0xc4, 0xc4, 0x25, 0x28, 0x30, 0xea, 0x45, 0xc1, 0xa8, 0xac, 0x88,
-	0x83, 0xd4, 0x52, 0x5f, 0x40, 0x21, 0xc9, 0x81, 0x31, 0x6c, 0x5a, 0x76, 0xdd, 0x76, 0x2c, 0xd7,
-	0x31, 0x4e, 0x0d, 0xf3, 0xd2, 0x40, 0x3f, 0xe1, 0x0d, 0x58, 0x4b, 0x7d, 0xe6, 0x29, 0x92, 0x32,
-	0x21, 0x8d, 0x7a, 0xcb, 0x6d, 0x39, 0x36, 0x92, 0x71, 0x05, 0x4a, 0xa9, 0xaf, 0xe5, 0xd8, 0xae,
-	0x63, 0x10, 0xbd, 0xde, 0x3c, 0xae, 0x37, 0xce, 0x74, 0xa4, 0xa8, 0x1f, 0x25, 0x28, 0x5b, 0x94,
-	0x8b, 0xa6, 0x6f, 0x29, 0xb3, 0xe2, 0x30, 0xf4, 0xdf, 0x2e, 0x46, 0xea, 0x7f, 0xc8, 0x8f, 0xe7,
-	0xa0, 0xa2, 0xf7, 0xcd, 0xda, 0x81, 0x98, 0x7a, 0xd1, 0x7d, 0x31, 0x3a, 0x25, 0xc9, 0x0d, 0xf5,
-	0x08, 0xf2, 0xc2, 0xc6, 0xdb, 0xb0, 0x31, 0x6e, 0x47, 0xcf, 0x0c, 0xf1, 0x33, 0xac, 0x26, 0x2e,
-	0xd3, 0x40, 0xd2, 0x64, 0x24, 0xdd, 0x35, 0xdb, 0x6d, 0x24, 0xab, 0x5f, 0x25, 0xd8, 0x9b, 0x53,
-	0x22, 0x25, 0xe2, 0xf1, 0x14, 0x11, 0x7f, 0x2d, 0x6a, 0x69, 0x3e, 0x1d, 0x77, 0xa0, 0xcb, 0xf7,
-	0x40, 0x7f, 0x27, 0x3d, 0x14, 0xf5, 0x12, 0xe0, 0x8c, 0x8f, 0xe8, 0x4f, 0x1d, 0xdd, 0xb2, 0x91,
-	0x32, 0x19, 0xdf, 0xb1, 0x5c, 0xc3, 0x74, 0xc9, 0x79, 0x07, 0xe5, 0xf0, 0x0e, 0xa0, 0xd4, 0x45,
-	0xce, 0x3b, 0xae, 0x4e, 0x88, 0x49, 0x50, 0x5e, 0xfd, 0x1b, 0x70, 0xd3, 0xeb, 0x5e, 0xd3, 0x76,
-	0xc0, 0x5a, 0x71, 0x56, 0xbd, 0x31, 0xf3, 0x27, 0x9c, 0xc4, 0xcc, 0x57, 0xbf, 0x48, 0x50, 0xbc,
-	0x17, 0xb8, 0x54, 0xa2, 0x73, 0x22, 0xa7, 0x31, 0x49, 0x4b, 0xc8, 0xdf, 0x4b, 0x2c, 0x94, 0xe6,
-	0xab, 0x1f, 0x01, 0xa9, 0x08, 0x5b, 0xa9, 0xd9, 0x34, 0x0d, 0xfb, 0xc4, 0x70, 0x74, 0x24, 0x67,
-	0x46, 0x37, 0x4c, 0xdb, 0x6d, 0x9b, 0x8e, 0xd1, 0x42, 0x4a, 0x26, 0x9b, 0x7d, 0xd2, 0xd1, 0x4d,
-	0xc7, 0x46, 0x39, 0x95, 0x42, 0xa9, 0xe9, 0xf9, 0xbe, 0x45, 0xd9, 0x4d, 0xf0, 0x6c, 0xe8, 0x93,
-	0xb0, 0xbb, 0x58, 0xa6, 0x25, 0x28, 0x0c, 0x29, 0xbf, 0x0e, 0x7a, 0x13, 0x56, 0x13, 0x0b, 0xff,
-	0x09, 0x39, 0x8f, 0xf5, 0xa3, 0xb2, 0xb2, 0xaf, 0x1c, 0xae, 0xd7, 0x36, 0xaa, 0xe9, 0xb6, 0xb8,
-	0xf0, 0xfc, 0x98, 0x12, 0x71, 0xa4, 0x7e, 0x90, 0x61, 0x77, 0xa6, 0x4e, 0x8a, 0xe8, 0xa3, 0x29,
-	0x44, 0x0f, 0x52, 0x44, 0xe7, 0x46, 0x4f, 0xa3, 0x7a, 0x00, 0xf9, 0x9b, 0x71, 0x1d, 0xd1, 0xd2,
-	0x4c, 0xf1, 0xe4, 0x0c, 0xef, 0x40, 0xfe, 0xca, 0x8b, 0x7d, 0x2e, 0x70, 0x5e, 0x25, 0x89, 0xa1,
-	0xbe, 0x7f, 0xb0, 0x18, 0xb3, 0x30, 0xbb, 0x1d, 0xdd, 0x3e, 0x36, 0xc7, 0x30, 0xdf, 0x31, 0x62,
-	0x98, 0xae, 0xa5, 0x93, 0x0b, 0x13, 0xe5, 0x32, 0xba, 0x15, 0x9e, 0x89, 0x1c, 0x6b, 0x9f, 0x64,
-	0x28, 0x5c, 0x8a, 0xbd, 0x8b, 0x9f, 0xc0, 0x7a, 0x66, 0xd3, 0xe1, 0xdd, 0xd9, 0xdd, 0x27, 0x88,
-	0xa9, 0x94, 0x17, 0x2d, 0x45, 0x4c, 0x60, 0x7b, 0xe6, 0x89, 0xe2, 0xdf, 0x96, 0x6e, 0x93, 0xca,
-	0xef, 0xcb, 0x5f, 0x36, 0x6e, 0xc0, 0x7a, 0x46, 0xdc, 0x69, 0x57, 0xb3, 0x2f, 0x28, 0xed, 0x6a,
-	0xce, 0x3b, 0xf8, 0x57, 0xc2, 0x67, 0xb0, 0x35, 0x45, 0x27, 0xfe, 0x65, 0x3e, 0xc9, 0x49, 0xae,
-	0x5f, 0x97, 0x29, 0xa0, 0xa1, 0x3d, 0xff, 0xa7, 0x1f, 0x54, 0xbb, 0xd7, 0x2c, 0x18, 0x0e, 0xe2,
-	0x61, 0x35, 0x60, 0x7d, 0x6d, 0x62, 0x04, 0x91, 0x36, 0x18, 0x5d, 0x31, 0x4f, 0x13, 0x5f, 0x2a,
-	0xad, 0x1f, 0x68, 0xdc, 0x8f, 0x5e, 0x16, 0x84, 0xf5, 0xdf, 0xb7, 0x00, 0x00, 0x00, 0xff, 0xff,
-	0xc3, 0x60, 0xc8, 0x50, 0xe5, 0x06, 0x00, 0x00,
+	// 699 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x55, 0xdd, 0x6e, 0xd3, 0x4a,
+	0x10, 0x3e, 0xce, 0xdf, 0x69, 0xa7, 0xa7, 0xed, 0x76, 0x53, 0xa5, 0x39, 0xe5, 0xaf, 0xb8, 0x02,
+	0xf5, 0x86, 0x18, 0x85, 0x8b, 0x0a, 0x01, 0x12, 0x6d, 0xe2, 0x88, 0xaa, 0xc4, 0x2e, 0x6b, 0xbb,
+	0x45, 0xdc, 0x58, 0x26, 0xd9, 0xa6, 0x41, 0x4e, 0x6c, 0x76, 0xd7, 0x2d, 0xdc, 0x21, 0x1e, 0x82,
+	0x6b, 0x1e, 0x81, 0x87, 0xe2, 0x15, 0xb8, 0x47, 0x59, 0xaf, 0xc1, 0x4d, 0xd2, 0x4a, 0x88, 0xab,
+	0xf8, 0x9b, 0x9d, 0x9d, 0xf9, 0xe6, 0x9b, 0x99, 0x0d, 0x20, 0x11, 0x72, 0xe3, 0x62, 0xc8, 0x86,
+	0xe3, 0x41, 0x23, 0x66, 0x91, 0x88, 0x70, 0x51, 0x84, 0x7c, 0xb3, 0xfa, 0x61, 0x14, 0xb2, 0xb8,
+	0x67, 0xa4, 0x3f, 0xe9, 0x89, 0xfe, 0x14, 0xb0, 0x1d, 0xd3, 0x71, 0x3b, 0x11, 0x47, 0x11, 0x13,
+	0x84, 0xbe, 0x4f, 0x28, 0x17, 0x18, 0x43, 0x69, 0x1c, 0x8c, 0x68, 0x5d, 0xdb, 0xd2, 0x76, 0x16,
+	0x89, 0xfc, 0x9e, 0xd8, 0xe2, 0x88, 0x89, 0x7a, 0x61, 0x4b, 0xdb, 0x29, 0x13, 0xf9, 0xad, 0xb7,
+	0xa0, 0x7a, 0xe9, 0x36, 0x8f, 0xa3, 0x31, 0xa7, 0xb8, 0x0e, 0xff, 0x06, 0xfd, 0x3e, 0xa3, 0x9c,
+	0xab, 0x08, 0x19, 0x9c, 0x1b, 0xe4, 0xab, 0x06, 0x75, 0x87, 0x0a, 0x19, 0xe4, 0x82, 0x32, 0x27,
+	0x89, 0xe3, 0xf0, 0x63, 0xc6, 0x04, 0x41, 0xb1, 0x9f, 0x08, 0x15, 0x66, 0xf2, 0x89, 0x1f, 0x43,
+	0x99, 0x8b, 0x40, 0x50, 0x19, 0x63, 0xa5, 0xb9, 0xdd, 0x10, 0x21, 0x6f, 0x5c, 0x75, 0xbf, 0xe1,
+	0x4c, 0x5c, 0x49, 0x7a, 0x43, 0xdf, 0x85, 0xb2, 0xc4, 0x78, 0x0d, 0x96, 0x1d, 0x77, 0xcf, 0x35,
+	0x7d, 0xcf, 0x3a, 0xb4, 0xec, 0x13, 0x0b, 0xfd, 0x83, 0xff, 0x83, 0x85, 0xd4, 0x64, 0x5b, 0x48,
+	0xc3, 0xcb, 0xb0, 0xa8, 0x50, 0xa7, 0x83, 0x0a, 0xfa, 0x0f, 0x0d, 0xfe, 0x9f, 0x93, 0x42, 0x95,
+	0xfb, 0x0c, 0x2a, 0x93, 0xf8, 0x49, 0x5a, 0xed, 0x4a, 0xf3, 0xde, 0x55, 0x94, 0x52, 0x7f, 0xc9,
+	0x29, 0xe1, 0x44, 0x5d, 0xc2, 0x35, 0xa8, 0x30, 0x1a, 0xf0, 0x68, 0x2c, 0x2b, 0x5a, 0x24, 0x0a,
+	0xe9, 0x9f, 0x34, 0xa8, 0xa4, 0xae, 0x18, 0xc3, 0xca, 0x84, 0x8e, 0xe7, 0xe4, 0x08, 0x2b, 0x8a,
+	0x9e, 0xe3, 0xdb, 0x87, 0x48, 0xcb, 0xb9, 0xec, 0xef, 0xb5, 0xfd, 0xb6, 0xe7, 0xa2, 0x02, 0xae,
+	0x01, 0xce, 0xd9, 0x88, 0xf9, 0xca, 0x33, 0x1d, 0x17, 0x15, 0xb3, 0xf2, 0x3d, 0xc7, 0xb7, 0x6c,
+	0x9f, 0x1c, 0x75, 0x51, 0x09, 0xaf, 0x03, 0x52, 0x26, 0x72, 0xd4, 0xf5, 0x4d, 0x42, 0x6c, 0x82,
+	0xca, 0xfa, 0x7d, 0xc0, 0xad, 0xa0, 0x77, 0x46, 0x3b, 0x11, 0x6b, 0x27, 0x22, 0xd7, 0x93, 0x84,
+	0x85, 0x59, 0x4f, 0x12, 0x16, 0xea, 0xdf, 0x35, 0xa8, 0x5e, 0x72, 0x54, 0xca, 0xec, 0x4e, 0x29,
+	0x73, 0x47, 0x2a, 0x33, 0xc7, 0x73, 0x5a, 0x13, 0x95, 0xa2, 0xf0, 0x2b, 0x45, 0x4e, 0xa5, 0xe2,
+	0x25, 0x95, 0xde, 0xfd, 0x89, 0x48, 0x55, 0x58, 0x55, 0xb0, 0x65, 0x5b, 0xee, 0x81, 0xe5, 0x99,
+	0xa8, 0x90, 0x2b, 0xdd, 0xb2, 0x5d, 0xbf, 0x63, 0x7b, 0x56, 0x1b, 0x15, 0x73, 0xd1, 0xdc, 0x83,
+	0xae, 0x69, 0x7b, 0x2e, 0x2a, 0xe9, 0x14, 0x6a, 0xad, 0x20, 0x0c, 0x1d, 0xca, 0xce, 0xa3, 0xd7,
+	0xa3, 0x90, 0xc4, 0xbd, 0xab, 0xc7, 0xb4, 0x06, 0x95, 0x11, 0x15, 0x67, 0x51, 0x3f, 0xeb, 0x6a,
+	0x8a, 0xf0, 0x5d, 0x28, 0x05, 0x6c, 0xc0, 0xeb, 0xc5, 0xad, 0xe2, 0xce, 0x52, 0x73, 0xb9, 0xa1,
+	0xb6, 0xf1, 0x38, 0x08, 0x13, 0x4a, 0xe4, 0x91, 0xfe, 0xa5, 0x00, 0x1b, 0x33, 0x79, 0x94, 0xa2,
+	0x4f, 0xa6, 0x14, 0xdd, 0x56, 0x8a, 0xce, 0xf5, 0x9e, 0x56, 0x75, 0x1b, 0xca, 0xe7, 0x93, 0x3c,
+	0x92, 0xd2, 0x4c, 0xf2, 0xf4, 0x0c, 0xaf, 0x43, 0xf9, 0x34, 0x48, 0x42, 0x21, 0x75, 0x5e, 0x20,
+	0x29, 0xd0, 0x3f, 0xff, 0xf5, 0x30, 0xe6, 0x65, 0xf6, 0xbb, 0xa6, 0xfb, 0xc2, 0x9e, 0xc8, 0xfc,
+	0xbb, 0x23, 0x96, 0xed, 0x3b, 0x26, 0x39, 0xb6, 0x51, 0x29, 0x37, 0xb7, 0xd2, 0x92, 0x8d, 0x63,
+	0xf3, 0x5b, 0x01, 0x2a, 0x27, 0xf2, 0x5d, 0xc3, 0xcf, 0x61, 0x29, 0xf7, 0xf2, 0xe0, 0x0d, 0x29,
+	0xc3, 0xec, 0x4b, 0xb6, 0x59, 0x9f, 0x3d, 0x50, 0x4a, 0x12, 0x58, 0x9b, 0x59, 0x51, 0x7c, 0xeb,
+	0xda, 0xd7, 0x64, 0xf3, 0xf6, 0xf5, 0x9b, 0x8d, 0xf7, 0x61, 0x29, 0x37, 0xdc, 0x8a, 0xd5, 0xec,
+	0x06, 0x29, 0x56, 0x73, 0xf6, 0xe0, 0xa1, 0x86, 0x5f, 0xc2, 0xea, 0x54, 0x3b, 0xf1, 0x8d, 0xf9,
+	0x4d, 0x4e, 0x63, 0xdd, 0xbc, 0x6e, 0x02, 0xf6, 0x8d, 0x37, 0x0f, 0x06, 0x51, 0xa3, 0x77, 0xc6,
+	0xa2, 0xd1, 0x30, 0x19, 0x35, 0x22, 0x36, 0x30, 0x32, 0x10, 0x71, 0x63, 0x38, 0x3e, 0x65, 0x81,
+	0x21, 0xff, 0x09, 0x8c, 0x41, 0x64, 0x88, 0x90, 0xbf, 0xad, 0x48, 0xf4, 0xe8, 0x67, 0x00, 0x00,
+	0x00, 0xff, 0xff, 0x3e, 0x89, 0x6e, 0x31, 0x45, 0x06, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -705,18 +662,33 @@
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
 type WiringClient interface {
-	// Open a port on the DUT for the caller.
-	// The TLE attempts to keep this port open for the duration of the
-	// RTD's runtime.
-	// This RPC can be called repeatedly for the same RTD, DUT, and port.
-	// On subsequent calls, the implementation should attempt to return the same address.
+	// Open a port on the DUT and return an address which the client can
+	// use to connect to the port on the DUT.
+	// The TLE SHOULD attempt to keep this address-to-port connection open for
+	// the duration of the RTD's runtime.
+	// The connection is not restarted if it is interrupted.
+	//
+	// If the connection from a previous call with the same arguments is
+	// still open, this RPC SHOULD do nothing and return the same
+	// response.
+	// If the previous connection was closed, the implementation SHOULD
+	// attempt to rebind and return the same address.
 	// If the implementation lost and cannot reobtain the previous
-	// address, it should return a new address.
+	// address, it MAY return a new address.
+	//
+	// This RPC does NOT ensure that there is a service running on the
+	// DUT for the given port.
+	// A service running on the given port MUST NOT required for this RPC
+	// to succeed.
+	// It is not specified whether this RPC will open the given port in
+	// the DUT's firewall, if the DUT has a firewall.
 	OpenDutPort(ctx context.Context, in *OpenDutPortRequest, opts ...grpc.CallOption) (*OpenDutPortResponse, error)
 	// SetDutPowerSupply sets the connected power state for the DUT.  It is
 	// the caller's responsibility to wait for the effects of the call
 	// to propagate, e.g. waiting in between calls to set the power OFF
 	// and ON.
+	//
+	// EXPERIMENTAL
 	SetDutPowerSupply(ctx context.Context, in *SetDutPowerSupplyRequest, opts ...grpc.CallOption) (*SetDutPowerSupplyResponse, error)
 	// CacheForDut caches some data to be accesible for the DUT.
 	// This will be made available to the DUT via a returned URL.
@@ -725,13 +697,13 @@
 	// to ensure the stream does not time out.
 	// The client should continue streaming replies until getting success or failure.
 	//
-	// Experimental
+	// EXPERIMENTAL
 	CacheForDut(ctx context.Context, in *CacheForDutRequest, opts ...grpc.CallOption) (Wiring_CacheForDutClient, error)
 	// CallServoXmlRpc performs an XML-RPC call against the servo connected to a DUT.
 	//
 	// This RPC mirrors the XML-RPC specification (http://xmlrpc.com/spec.md).
 	//
-	// Experimental
+	// EXPERIMENTAL
 	CallServoXmlRpc(ctx context.Context, in *CallServoXmlRpcRequest, opts ...grpc.CallOption) (*CallServoXmlRpcResponse, error)
 }
 
@@ -804,18 +776,33 @@
 
 // WiringServer is the server API for Wiring service.
 type WiringServer interface {
-	// Open a port on the DUT for the caller.
-	// The TLE attempts to keep this port open for the duration of the
-	// RTD's runtime.
-	// This RPC can be called repeatedly for the same RTD, DUT, and port.
-	// On subsequent calls, the implementation should attempt to return the same address.
+	// Open a port on the DUT and return an address which the client can
+	// use to connect to the port on the DUT.
+	// The TLE SHOULD attempt to keep this address-to-port connection open for
+	// the duration of the RTD's runtime.
+	// The connection is not restarted if it is interrupted.
+	//
+	// If the connection from a previous call with the same arguments is
+	// still open, this RPC SHOULD do nothing and return the same
+	// response.
+	// If the previous connection was closed, the implementation SHOULD
+	// attempt to rebind and return the same address.
 	// If the implementation lost and cannot reobtain the previous
-	// address, it should return a new address.
+	// address, it MAY return a new address.
+	//
+	// This RPC does NOT ensure that there is a service running on the
+	// DUT for the given port.
+	// A service running on the given port MUST NOT required for this RPC
+	// to succeed.
+	// It is not specified whether this RPC will open the given port in
+	// the DUT's firewall, if the DUT has a firewall.
 	OpenDutPort(context.Context, *OpenDutPortRequest) (*OpenDutPortResponse, error)
 	// SetDutPowerSupply sets the connected power state for the DUT.  It is
 	// the caller's responsibility to wait for the effects of the call
 	// to propagate, e.g. waiting in between calls to set the power OFF
 	// and ON.
+	//
+	// EXPERIMENTAL
 	SetDutPowerSupply(context.Context, *SetDutPowerSupplyRequest) (*SetDutPowerSupplyResponse, error)
 	// CacheForDut caches some data to be accesible for the DUT.
 	// This will be made available to the DUT via a returned URL.
@@ -824,13 +811,13 @@
 	// to ensure the stream does not time out.
 	// The client should continue streaming replies until getting success or failure.
 	//
-	// Experimental
+	// EXPERIMENTAL
 	CacheForDut(*CacheForDutRequest, Wiring_CacheForDutServer) error
 	// CallServoXmlRpc performs an XML-RPC call against the servo connected to a DUT.
 	//
 	// This RPC mirrors the XML-RPC specification (http://xmlrpc.com/spec.md).
 	//
-	// Experimental
+	// EXPERIMENTAL
 	CallServoXmlRpc(context.Context, *CallServoXmlRpcRequest) (*CallServoXmlRpcResponse, error)
 }
 
diff --git a/setup_cipd.sh b/setup_cipd.sh
new file mode 100755
index 0000000..227f021
--- /dev/null
+++ b/setup_cipd.sh
@@ -0,0 +1,27 @@
+# Copyright 2020 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# Sets up cipd packages for presubmit scripts.
+#
+# Scripts should set the script_dir variable and source this file:
+#
+#   readonly script_dir="$(dirname "$(realpath -e "${BASH_SOURCE[0]}")")"
+#   source "${script_dir}/setup_cipd.sh"
+
+# Versions of packages to get from CIPD.
+readonly CIPD_PROTOC_VERSION='v3.6.1'
+readonly CIPD_PROTOC_GEN_GO_VERSION='v1.3.2'
+
+readonly cipd_root="${script_dir}/.cipd_bin"
+cipd ensure \
+     -log-level warning \
+     -root "${cipd_root}" \
+     -ensure-file - \
+     <<ENSURE_FILE
+infra/tools/protoc/\${platform} protobuf_version:${CIPD_PROTOC_VERSION}
+chromiumos/infra/tools/protoc-gen-go version:${CIPD_PROTOC_GEN_GO_VERSION}
+infra/3pp/tools/go/\${platform} latest
+ENSURE_FILE
+PATH="${cipd_root}:${PATH}"
+PATH="${cipd_root}/bin:${PATH}"
diff --git a/src/tls/common.proto b/src/tls/common.proto
index 22341b8..9c62f31 100644
--- a/src/tls/common.proto
+++ b/src/tls/common.proto
@@ -10,30 +10,113 @@
 
 // Common lab services implemented on top of the wiring APIs.
 //
-// All clients should pass gRPC metadata key request_trace_id with one value.
+// The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
+// NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and
+// "OPTIONAL" in this document are to be interpreted as described in
+// RFC 2119.
+//
+// All clients SHOULD pass the gRPC metadata key request_trace_id with one value.
 // The value is a unique string that is associated with the method
 // call in metrics.
-// Clients that do not pass request_trace_id may be rejected so that
+// Clients that do not pass request_trace_id MAY be rejected so that
 // they can be fixed.
 service Common {
-  // Runs a shell command with the default shell.
-  // Does not spawn a tty.
-  rpc DutShell(DutShellRequest) returns (stream DutShellResponse);
+  // ExecDutCommand runs a command on a DUT.
+  //
+  // The working directory is /.
+  // A tty is not spawned for the command.
+  // The user and group is root.
+  // All signals have their default dispositions and are not masked.
+  // The umask is set to 0.
+  //
+  // The environment contains:
+  //
+  //   TERM=dumb
+  //   PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/bin
+  //   LANG=en_US.UTF-8
+  //   USER=root
+  //   HOME=/root
+  //
+  // The environment MAY also contain SSH client variables.
+  // The environment SHALL NOT contain variables not mentioned above.
+  //
+  // If the stream is interrupted, the implementation MAY attempt to
+  // stop the command by sending SIGINT, SIGHUP, SIGTERM, or SIGKILL.
+  rpc ExecDutCommand(ExecDutCommandRequest) returns (stream ExecDutCommandResponse);
 }
 
-message DutShellRequest {
-  // dut is some identifier for the DUT.  This could be the DUT
-  // hostname, but the caller shouldn't know or care whether this is a
-  // hostname or not, as they would not be able to use the hostname to
-  // SSH or otherwise interact with the DUT directly.
-  string dut = 1;
+message ExecDutCommandRequest {
+  // name is the resource name for the DUT.
+  // The DUT name is passed to the RTD when the RTD is started.
+  // It is not specified whether the name is the DUT hostname.
+  string name = 1;
+  // command is the command to run.
+  // If this contains no slashes, it is resolved using PATH.
+  // If this starts with /, it is used as an absolute path to the
+  // program to run.
+  // Otherwise, this is treated as a path relative to the working
+  // directory.
   string command = 2;
+  // args are the arguments to pass to the command.
+  repeated string args = 3;
+  // stdin is passed to the command as the program's stdin.
+  // The stream does not support seeking.
+  // An empty bytes is not treated specially; if the command reads
+  // from stdin, it will receive zero bytes.
+  bytes stdin = 4;
+  // stdout indicates how to handle the command's stdout.
+  Output stdout = 5;
+  // stderr indicates how to handle the command's stderr.
+  Output stderr = 6;
+
 }
-// For the last response in the stream, exited will be true and status
-// will be set.
-message DutShellResponse {
-  int32 status = 1;
-  bool exited = 2;
-  bytes stdout = 3;
-  bytes stderr = 4;
+message ExecDutCommandResponse {
+  message ExitInfo {
+    // status provides information about how the command process
+    // terminated.
+    //
+    // If the command failed to start, status is set to an arbitrary
+    // non-zero value.
+    //
+    // If signaled is set, status is set to the signal that caused
+    // the command to terminate.
+    //
+    // Otherwise, status is set to the exit status of the process.
+    // Exit statuses outside of 0 to 255 inclusive are not supported;
+    // they will be mapped to an arbitrary non-zero value.
+    //
+    // status is zero if and only if the process was successfully
+    // started and exited with a zero status.
+    int32 status = 1;
+    // signaled indicates whether the command exited due to a signal.
+    // If set, status contains the signal.
+    bool signaled = 2;
+    // started indicates whether the command was started.
+    bool started = 3;
+    // error_message provides a human readable explanation for some errors.
+    // This MUST NOT be inspected by programs.
+    string error_message = 4;
+  }
+  // exit_info contains exit information.
+  // This is set when the command has exited or failed to start.
+  // This is set on the last message in the response stream.
+  ExitInfo exit_info = 1;
+  // stdout contains the shell command's stdout output since the last
+  // response in the stream.
+  // The implementation MAY batch or delay output to later
+  // responses in the stream.
+  bytes stdout = 2;
+  // stderr contains the shell command's stderr output since the last
+  // response in the stream.
+  // The implementation MAY batch or delay output to later
+  // responses in the stream.
+  bytes stderr = 3;
+}
+
+// Output enumeration for ExecDutCommandRequest.
+enum Output {
+  // OUTPUT_PIPE means to collect output and return it.
+  OUTPUT_PIPE = 0;
+  // OUTPUT_STDOUT is a special value for stderr which means to merge stderr into stdout.
+  OUTPUT_STDOUT = 1;
 }
diff --git a/src/tls/wiring.proto b/src/tls/wiring.proto
index f7fb40c..04c9000 100644
--- a/src/tls/wiring.proto
+++ b/src/tls/wiring.proto
@@ -13,26 +13,47 @@
 // Wiring APIs are implemented by TLS wiring providers for all low
 // level access to lab services.
 //
-// It is expected that TLEs do not implement most of the methods.
-// TLEs only need to implement the services that it wants to provide to clients.
+// The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
+// NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and
+// "OPTIONAL" in this document are to be interpreted as described in
+// RFC 2119.
 //
-// All clients should pass gRPC metadata key request_trace_id with one value.
-// The value is a unique string that is associated with the method call in metrics.
-// Clients that do not pass request_trace_id may be rejected so that they can be fixed.
+// Implementations of the service MAY leave methods unimplemented.
+//
+// All clients SHOULD pass the gRPC metadata key request_trace_id with one value.
+// The value is a unique string that is associated with the method
+// call in metrics.
+// Clients that do not pass request_trace_id MAY be rejected so that
+// they can be fixed.
 service Wiring {
-  // Open a port on the DUT for the caller.
-  // The TLE attempts to keep this port open for the duration of the
-  // RTD's runtime.
-  // This RPC can be called repeatedly for the same RTD, DUT, and port.
-  // On subsequent calls, the implementation should attempt to return the same address.
+  // Open a port on the DUT and return an address which the client can
+  // use to connect to the port on the DUT.
+  // The TLE SHOULD attempt to keep this address-to-port connection open for
+  // the duration of the RTD's runtime.
+  // The connection is not restarted if it is interrupted.
+  //
+  // If the connection from a previous call with the same arguments is
+  // still open, this RPC SHOULD do nothing and return the same
+  // response.
+  // If the previous connection was closed, the implementation SHOULD
+  // attempt to rebind and return the same address.
   // If the implementation lost and cannot reobtain the previous
-  // address, it should return a new address.
+  // address, it MAY return a new address.
+  //
+  // This RPC does NOT ensure that there is a service running on the
+  // DUT for the given port.
+  // A service running on the given port MUST NOT required for this RPC
+  // to succeed.
+  // It is not specified whether this RPC will open the given port in
+  // the DUT's firewall, if the DUT has a firewall.
   rpc OpenDutPort(OpenDutPortRequest) returns (OpenDutPortResponse);
 
   // SetDutPowerSupply sets the connected power state for the DUT.  It is
   // the caller's responsibility to wait for the effects of the call
   // to propagate, e.g. waiting in between calls to set the power OFF
   // and ON.
+  //
+  // EXPERIMENTAL
   rpc SetDutPowerSupply(SetDutPowerSupplyRequest) returns (SetDutPowerSupplyResponse);
 
   // CacheForDut caches some data to be accesible for the DUT.
@@ -42,46 +63,38 @@
   // to ensure the stream does not time out.
   // The client should continue streaming replies until getting success or failure.
   //
-  // Experimental
+  // EXPERIMENTAL
   rpc CacheForDut(CacheForDutRequest) returns (stream CacheForDutResponse);
 
   // CallServoXmlRpc performs an XML-RPC call against the servo connected to a DUT.
   //
   // This RPC mirrors the XML-RPC specification (http://xmlrpc.com/spec.md).
   //
-  // Experimental
+  // EXPERIMENTAL
   rpc CallServoXmlRpc(CallServoXmlRpcRequest) returns (CallServoXmlRpcResponse);
 }
 
 message OpenDutPortRequest {
-  // dut is some identifier for the DUT.
-  // The DUT ID is passed to the RTD when it is started.
-  // This could be the DUT hostname, but the caller should not be able
-  // to use the hostname to SSH or otherwise interact with the DUT
-  // directly.
-  string dut = 1;
-  // Port to open on the DUT.
-  int32 dut_port = 2;
+  // name is the resource name for the DUT.
+  // The DUT name is passed to the RTD when the RTD is started.
+  // It is not specified whether the name is the DUT hostname.
+  string name = 1;
+  // port is the port to open on the DUT.
+  int32 port = 2;
 }
 message OpenDutPortResponse {
-  enum Status {
-    STATUS_UNKNOWN = 0;
-    STATUS_OK = 1;
-    // STATUS_BAD_DUT indicates that the DUT is not known,
-    // or the caller does not have access to it.
-    STATUS_BAD_DUT = 2;
-    // STATUS_DUT_UNREACHABLE indicates that the DUT is not reachable
-    // over the network.
-    STATUS_DUT_UNREACHABLE = 3;
-  }
-  Status status = 1;
-  // address which is forwarded to the DUT, in the form host:port.
-  // TLEs should return an IP address to avoid name resolution issues.
-  // If TLEs return a hostname, they should ensure that the hostname is
-  // resolveable by the RTD via standard name resolution facilities.
-  string address = 2;
-  // reason provides human friendly context for any error status.
-  string reason = 3;
+  // address for which a port is forwarded to the DUT.
+  // TLEs SHOULD return an IPv4 or IPv6 address to avoid name
+  // resolution issues.
+  // IPv4 addresses MUST be in standard dotted decimal notation.
+  // IPv6 addresses MUST be formatted according to RFC4291, Section
+  // 2.2.  The mixed IPv4 and IPv6 form MUST NOT be used.
+  // If TLEs return a hostname, they SHOULD ensure that the hostname
+  // can be resolved by the RTD via standard name resolution
+  // facilities.
+  string address = 1;
+  // port on the address which is forwarded to the DUT.
+  int32 port = 2;
 }
 
 message SetDutPowerSupplyRequest {