Index: examples/python_tests/Makefile
===================================================================
--- examples/python_tests/Makefile	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/Makefile	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,5 +1,4 @@
 
-
-DIRECTORY= access_rt2 acme_friend_rt1 acme_rockets_intersection_rt0 acme_rockets_rt0 alice_rt1 alumni2_rt1 alumni3_rt1 alumni_rt1 balltime_rt2 evaluator_rt1 experiment_create_rt0 file_read_rt2 fruits_rt2 leader_rt1 payraise_rt1 acme_multi_rt0 experiment_multi_rt0 basic_id basic_attribute partial_proof_rt1
+DIRECTORY= access_rt2 acme_friend_rt1 acme_rockets_intersection_rt0 acme_rockets_rt0 alice_rt1 alumni2_rt1 alumni3_rt1 alumni_rt1 balltime_rt2 evaluator_rt1 experiment_create_rt0 file_read_rt2 fruits_rt2 leader_rt1 payraise_rt1 acme_multi_rt0 experiment_multi_rt0 basic_id basic_attribute partial_proof_rt1 alumni3_ctxt_rt1 access_ctxt_rt2
 
 .PHONY : runcheck clean 
@@ -9,5 +8,4 @@
 	@for i in $(DIRECTORY); do \
 	here=`pwd`; \
-	printf "\n ==> CLEANING on %s\n" "$$i"; \
 	cd $$i; \
 	rm -rf *.der *.pem *.cn *.sha *.log *.pl; \
@@ -18,5 +16,5 @@
 runcheck: 
 	@echo 'running libabac PYTHON testing...' 
-	@for i in $(DIRECTORY); do \
+	for i in $(DIRECTORY); do \
 	here=`pwd`; \
 	printf "\n ==> RUN on %s\n" "$$i" >> allout.tmp 2>&1; \
Index: examples/python_tests/access_ctxt_rt2/README
===================================================================
--- examples/python_tests/access_ctxt_rt2/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/access_ctxt_rt2/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,58 @@
+#####################################################################
+# This example shows the use of multiple contexts in one session. 
+# This is based on access_rt2. It demonstrates using an oset (object set)
+# to control access to files based on the attributes of the principals.
+# The script creates three principals Alpha, Bob and Joe and sets out 
+# the access policy.
+# 
+# files are named by URNs and are not principals.
+# 
+# A principal's access rights are controlled by the Alpha principal.  If a 
+# principal has the role role::acess(string:'Read', urn:filename) that 
+# principal can Read filename.  
+# The policy names 2 teams, proj1 and proj2.  A principal is on proj1 if it
+# has the role team(string:'proj1') defined by Alpha (written
+# [keyid:Alpha].role:team(string:'proj1')).  Each project has an associated set
+# of files, defined by object sets.  A file is in proj1's documents if it is in
+# the oset of documents('proj1') defined by Alpha, written
+# [keyid:Alpha].oset:documents(string:'proj1'))
+# 
+# The example below lays out the policy that members of a given project can
+# Read the documents of that project in Credential 1 and adds file://fileA to
+# the document set for proj1 in Credential 2 - note that no principal is
+# required for fileA.  It adds file://fileB to the proj2 in Credential 3 and
+# file://fileC to proj2 in Credential 4 and to proj1 in Credential 5 (shared
+# by both projects).
+# Credentials 6 & 7 add Bob to proj1 and Joe to proj2.
+#
+# The attached query.py file runs queries in multiple contexts.
+# 3 kinds of contexts are made. context#A includes Credential 1-7.
+# context#B is partial dup of context#A with Credential from 1,(no 2),3-7.
+# context#C includes Credential 1-3,(no 4),5-7.  Various queries are made againt each context.
+# First it confirms that Bob can Read fileA from context#A and context#C but not
+# context#B, then it confirms that Joe cannot read fileA from any of contexts.
+# Finally it confirms that Joe can read fileC from context#A and context#B but not
+# context#C.
+
+# access_ctxt_rt2
+
+# Credential 1
+#[keyid:alpha].role:access([string:'Read'],
+#                    [urn:?F[keyid:alpha].oset:documents([string:?P])])
+#                                     <- [keyid:alpha].role:team([string:?P]) 
+
+# Credential 2
+#[keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA'] 
+# Credential 3
+#[keyid:alpha].oset:documents([string:'proj2'])<-[urn:'file//fileB'] 
+# Credential 4
+#[keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileC'] 
+# Credential 5
+#[keyid:alpha].oset:documents([string:'proj2'])<-[urn:'file//fileC'] 
+
+# Credential 6
+# [keyid:alpha].role:team([string:'proj1'])<-[keyid:Bob]
+# Credential 7
+# [keyid:alpha].role:team([string:'proj2'])<-[keyid:Joe]
+
+
Index: examples/python_tests/access_ctxt_rt2/attr.py
===================================================================
--- examples/python_tests/access_ctxt_rt2/attr.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/access_ctxt_rt2/attr.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,156 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+creates a principal(Joe) and constructs the credentials described and puts 
+copies into this directory
+
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+# Print the principals and credentials in the keystore
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+# Construct a "Joe" principal and load it into the ABAC context
+joeID=ABAC.ID("Joe", 0)
+ctxt.load_id(joeID)
+# Write out the Joe Principal to 2 files - one for the key and one for the
+# identity.  The identity can be shared, but the key must be kept secret.
+joeID.id_write_privkey("Joe_private.pem")
+joeID.id_write_cert("Joe_ID.pem")
+# Keep a copy of Joe's key identifier as a string.
+joe=joeID.id_keyid()
+
+# Load alpha and bob from local files (created by ./setup.py)
+alphaID=ABAC.ID("Alpha_ID.pem")
+alphaID.id_load_privkey_file("Alpha_private.pem");
+alpha=alphaID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+################################################
+# [keyid:alpha].role:access([string:'Read',
+#                [urn:?F[keyid:alpha].oset:documents([string:?P])])
+#                                 <- [keyid:alpha].role:team([string:?P]) 
+# Credential 1
+param=ABAC.DataTerm("string", "P")
+oset=ABAC.Oset(alpha,"documents")
+oset.oset_add_data_term(param)
+cond=ABAC.Constraint(oset)
+param2=ABAC.DataTerm("urn", "F", cond)
+param1=ABAC.DataTerm("string", "'Read'")
+head = ABAC.Role(alpha,"access")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+param3=ABAC.DataTerm("string", "P")
+tail = ABAC.Role(alpha,"team")
+tail.role_add_data_term(param3)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_access_qFqP__alpha_team_qP_attr.der")
+
+#################################################
+## [keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA']
+## Credential 2
+param1=ABAC.DataTerm("string", "'proj1'")
+head = ABAC.Oset(alpha,"documents")
+head.oset_add_data_term(param1)
+obj = ABAC.DataTerm("urn", "'file//fileA'")
+tail= ABAC.Oset(obj)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_team_proj1__fileA_attr.der")
+
+#################################################
+## [keyid:alpha].oset:documents([string:'proj2'])<-[urn:'file//fileB']
+## Credential 3
+param1=ABAC.DataTerm("string", "'proj2'")
+head = ABAC.Oset(alpha,"documents")
+head.oset_add_data_term(param1)
+obj = ABAC.DataTerm("urn", "'file//fileB'")
+tail= ABAC.Oset(obj)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_team_proj2__fileB_attr.der")
+
+#################################################
+## [keyid:alpha].oset:documents([string:'proj2'])<-[urn:'file//fileC']
+## Credential 4
+param1=ABAC.DataTerm("string", "'proj2'")
+head = ABAC.Oset(alpha,"documents")
+head.oset_add_data_term(param1)
+obj = ABAC.DataTerm("urn", "'file//fileC'")
+tail= ABAC.Oset(obj)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_team_proj2__fileC_attr.der")
+
+#################################################
+## [keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileC']
+## Credential 5
+param1=ABAC.DataTerm("string", "'proj1'")
+head = ABAC.Oset(alpha,"documents")
+head.oset_add_data_term(param1)
+obj = ABAC.DataTerm("urn", "'file//fileC'")
+tail= ABAC.Oset(obj)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_team_proj1__fileC_attr.der")
+
+#################################################
+## [keyid:alpha].role:team([string:'proj1'])<-[keyid:bob]
+## Credential 6
+param1=ABAC.DataTerm("string", "'proj1'")
+head = ABAC.Role(alpha,"team")
+head.role_add_data_term(param1)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_team_proj1__Bob_attr.der")
+
+#################################################
+## [keyid:alpha].role:team([string:'proj2'])<-[keyid:joe]
+## Credential 7
+param1=ABAC.DataTerm("string", "'proj2'")
+head = ABAC.Role(alpha,"team")
+head.role_add_data_term(param1)
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_team_proj2__Joe_attr.der")
+
+
Index: examples/python_tests/access_ctxt_rt2/ctxt.save
===================================================================
--- examples/python_tests/access_ctxt_rt2/ctxt.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/access_ctxt_rt2/ctxt.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,89 @@
+YAP 6.3.4 (i686-linux): Thu Mar  7 13:05:19 PST 2013
+
+...ctxtA principals
+(pAlpha,keyid,y) 
+(pBob,keyid,n) 
+(pJoe,keyid,n) 
+
+...ctxtA attributes
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj2') <- 'file//fileB'
+pAlpha.documents('proj2') <- 'file//fileC'
+pAlpha.documents('proj1') <- 'file//fileC'
+pAlpha.team('proj1') <- pBob
+pAlpha.team('proj2') <- pJoe
+pAlpha.documents('proj1') <- 'file//fileA'
+
+...ctxtB principals
+(pAlpha,keyid,y) 
+(pBob,keyid,n) 
+(pJoe,keyid,n) 
+
+...ctxtB attributes
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj2') <- 'file//fileB'
+pAlpha.documents('proj2') <- 'file//fileC'
+pAlpha.documents('proj1') <- 'file//fileC'
+pAlpha.team('proj1') <- pBob
+pAlpha.team('proj2') <- pJoe
+
+...ctxtC principals
+(pAlpha,keyid,y) 
+(pBob,keyid,n) 
+(pJoe,keyid,n) 
+
+...ctxtC attributes
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj1') <- 'file//fileA'
+pAlpha.documents('proj2') <- 'file//fileB'
+pAlpha.documents('proj1') <- 'file//fileC'
+pAlpha.team('proj1') <- pBob
+pAlpha.team('proj2') <- pJoe
+
+
+===good============ ctxtA,Alpha.access(Read,fileA)<-?-Bob
+YAP query succeed
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj1') <- 'file//fileA'
+pAlpha.team('proj1') <- pBob
+
+
+===bad============ ctxtB,Alpha.access(Read,fileA)<-?-Bob
+YAP query failed
+
+
+===good============ ctxtC,Alpha.access(Read,fileA)<-?-Bob
+YAP query succeed
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj1') <- 'file//fileA'
+pAlpha.team('proj1') <- pBob
+
+
+===bad============ ctxtA,Alpha.access(Read,fileA)<-?-Joe
+YAP query failed
+
+
+===bad============ ctxtB,Alpha.access(Read,fileA)<-?-Joe
+YAP query failed
+
+
+===bad============ ctxtC,Alpha.access(Read,fileA)<-?-Joe
+YAP query failed
+
+
+===good============ ctxtA,Alpha.access(Read,fileC)<-?-Joe
+YAP query succeed
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj2') <- 'file//fileC'
+pAlpha.team('proj2') <- pJoe
+
+
+===good============ ctxtB,Alpha.access(Read,fileC)<-?-Joe
+YAP query succeed
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.documents('proj2') <- 'file//fileC'
+pAlpha.team('proj2') <- pJoe
+
+
+===bad============ ctxtC,Alpha.access(Read,fileC)<-?-Joe
+YAP query failed
Index: examples/python_tests/access_ctxt_rt2/query.py
===================================================================
--- examples/python_tests/access_ctxt_rt2/query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/access_ctxt_rt2/query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,128 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd1:env keystore=`pwd` ./query.py
+cmd2:env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+
+##########################################
+# dump the loaded principals/policies
+#
+def dumpCred(CTXT, STRING):
+   out = CTXT.context_principals()
+   print "\n...%s principals" %STRING
+   for x in out[1]:
+       print "%s " % x.string()
+   out = CTXT.context_credentials()
+   print "\n...%s attributes" %STRING
+   for c in out[1]:
+       print "%s <- %s" % (c.head_string(), c.tail_string())
+   return
+
+##########################################
+# role =[keyid:WHOM].role:access([string:'Read'],[urn:FILE])
+# p = "[keyid:WHO]"
+def askAbout(CTXT,WHOM,WHO,FILE,STRING):
+   print "\n%s" %STRING
+   param1=ABAC.DataTerm("string", "'Read'")
+   param2=ABAC.DataTerm("urn",FILE)
+# bad -- seg faults
+#   param2=ABAC.DataTerm("urn","file://fileA") -- seg faults
+   role = ABAC.Role(WHOM,"access")
+   role.role_add_data_term(param1)
+   role.role_add_data_term(param2)
+   p = ABAC.Role(WHO)
+#   print role.typed_string()
+#   print p.typed_string()
+   out = CTXT.query(role, p)
+   for c in out[1]:
+       print "%s <- %s" % (c.head_string(), c.tail_string())
+   return
+
+###############################
+ctxtA = ABAC.Context()
+ctxtA.set_no_partial_proof()
+
+ctxtC = ABAC.Context()
+ctxtC.set_no_partial_proof()
+###############################
+
+# retrieve principals' keyid value from local credential files
+alphaUID=ABAC.ID("Alpha_ID.pem")
+alphaUID.id_load_privkey_file("Alpha_private.pem")
+alpha=alphaUID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bob=bobID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem")
+joe=joeID.id_keyid()
+
+##########################################################################
+## ctxtA  - credential 1-7
+## ctxtB  - credential 1, no2, 3-7
+## ctxtC  - credential 1-3, no4, 6-7
+ctxtA.load_id(alphaUID)
+ctxtA.load_id(bobID)
+ctxtA.load_id(joeID)
+
+ctxtC.load_id(alphaUID)
+ctxtC.load_id(bobID)
+ctxtC.load_id(joeID)
+
+#1
+ctxtA.load_attribute_file("Alpha_access_qFqP__alpha_team_qP_attr.der");
+ctxtC.load_attribute_file("Alpha_access_qFqP__alpha_team_qP_attr.der");
+#2
+ctxtC.load_attribute_file("Alpha_team_proj1__fileA_attr.der");
+#3
+ctxtA.load_attribute_file("Alpha_team_proj2__fileB_attr.der");
+ctxtC.load_attribute_file("Alpha_team_proj2__fileB_attr.der");
+#4
+ctxtA.load_attribute_file("Alpha_team_proj2__fileC_attr.der");
+#5
+ctxtA.load_attribute_file("Alpha_team_proj1__fileC_attr.der");
+ctxtC.load_attribute_file("Alpha_team_proj1__fileC_attr.der");
+#6
+ctxtA.load_attribute_file("Alpha_team_proj1__Bob_attr.der");
+ctxtC.load_attribute_file("Alpha_team_proj1__Bob_attr.der");
+#7
+ctxtA.load_attribute_file("Alpha_team_proj2__Joe_attr.der");
+ctxtC.load_attribute_file("Alpha_team_proj2__Joe_attr.der");
+
+ctxtB = ABAC.Context(ctxtA)
+ctxtB.set_no_partial_proof()
+
+# add 2
+ctxtA.load_attribute_file("Alpha_team_proj1__fileA_attr.der");
+
+##########################################################################
+# Construct and run the queries.  In each case we create a role object and a
+# principal and call the query method on the context.  The contents of the
+# proof are printed for successful queries.
+# role is the role to look for
+# p is the principal to check.
+##########################################################################
+
+dumpCred(ctxtA, "ctxtA")
+dumpCred(ctxtB, "ctxtB")
+dumpCred(ctxtC, "ctxtC")
+
+askAbout(ctxtA,alpha,bob,"'file//fileA'","\n===good============ ctxtA,Alpha.access(Read,fileA)<-?-Bob")
+askAbout(ctxtB,alpha,bob,"'file//fileA'","\n===bad============ ctxtB,Alpha.access(Read,fileA)<-?-Bob")
+askAbout(ctxtC,alpha,bob,"'file//fileA'","\n===good============ ctxtC,Alpha.access(Read,fileA)<-?-Bob")
+
+askAbout(ctxtA,alpha,joe,"'file//fileA'","\n===bad============ ctxtA,Alpha.access(Read,fileA)<-?-Joe")
+askAbout(ctxtB,alpha,joe,"'file//fileA'","\n===bad============ ctxtB,Alpha.access(Read,fileA)<-?-Joe")
+askAbout(ctxtC,alpha,joe,"'file//fileA'","\n===bad============ ctxtC,Alpha.access(Read,fileA)<-?-Joe")
+
+askAbout(ctxtA,alpha,joe,"'file//fileC'","\n===good============ ctxtA,Alpha.access(Read,fileC)<-?-Joe")
+askAbout(ctxtB,alpha,joe,"'file//fileC'","\n===good============ ctxtB,Alpha.access(Read,fileC)<-?-Joe")
+askAbout(ctxtC,alpha,joe,"'file//fileC'","\n===bad============ ctxtC,Alpha.access(Read,fileC)<-?-Joe")
Index: examples/python_tests/access_ctxt_rt2/run_prover
===================================================================
--- examples/python_tests/access_ctxt_rt2/run_prover	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/access_ctxt_rt2/run_prover	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+#===bad============ Alpha.access(Read,fileA)<-?-Joe
+#===good============ Alpha.access(Read,fileA)<-?-Bob
+#param1=ABAC.DataTerm("string", "'Read'")
+#param2=ABAC.DataTerm("urn","'file//fileA'")
+
+keystore=`pwd`
+pID=`creddy --keyid --cert ${keystore}/Alpha_ID.pem`
+cID=`creddy --keyid --cert ${keystore}/Joe_ID.pem`
+bID=`creddy --keyid --cert ${keystore}/Bob_ID.pem`
+
+role="[keyid:${pID}].role:access([string:'Read'],[urn:'file//fileA'])"
+principal="[keyid:${cID}]"
+
+env ABAC_CN=1 ../../example_scripts/c/abac_prover "$keystore" "$role" "$principal"
+
+#echo "$keystore" "$role" "$principal"
+#gdb ../../example_scripts/c/abac_prover
+
+
+
Index: examples/python_tests/access_ctxt_rt2/run_test
===================================================================
--- examples/python_tests/access_ctxt_rt2/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/access_ctxt_rt2/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,35 @@
+#!/bin/sh 
+
+env |grep SKIP
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>ctxt.log 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > ctxt.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>ctxt.cn 2>&1
+
+result=`diff -I "Restoring file" -I "YAP 6.3" ctxt.cn ctxt.save`
+
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:access_ctxt_rt2 test result differs!!!"
+    fi
+else
+    echo "   ERROR:access_ctxt_rt2 test result differs!!!"
+fi
+
+
Index: examples/python_tests/access_ctxt_rt2/setup.py
===================================================================
--- examples/python_tests/access_ctxt_rt2/setup.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/access_ctxt_rt2/setup.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,19 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates two of three prinicpals 
+(Alpha and Bob) used by the example. 
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+alphaID=ABAC.ID("Alpha", 0)
+alphaID.id_write_cert("Alpha_ID.pem")
+alphaID.id_write_privkey("Alpha_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.id_write_cert("Bob_ID.pem")
+bobID.id_write_privkey("Bob_private.pem")
Index: examples/python_tests/access_rt2/README
===================================================================
--- examples/python_tests/access_rt2/README	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/access_rt2/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -10,5 +10,5 @@
 # principal has the role role::acess(string:'Read', urn:filename) that 
 # principal can Read filename.  
-# The policy names 2 teams, proj1 and proj1.  A principal is on proj1 if it
+# The policy names 2 teams, proj1 and proj2.  A principal is on proj1 if it
 # has the role team(string:'proj1') defined by Alpha (written
 # [keyid:Alpha].role:team(string:'proj1')).  Each project has an associated set
Index: examples/python_tests/access_rt2/attr.py
===================================================================
--- examples/python_tests/access_rt2/attr.py	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/access_rt2/attr.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -77,5 +77,7 @@
 # Save a copy and add the credential to the context
 attr.attribute_write_cert("Alpha_access_fileB__Bob_attr.der")
-ctxt.load_attribute_file("Alpha_access_fileB__Bob_attr.der")
+#XXX
+##Xctxt.load_attribute_file("Alpha_access_fileB__Bob_attr.der")
+ctxt.load_attribute(attr)
 print attr.string() 
 print attr.typed_string()
Index: examples/python_tests/access_rt2/query.py
===================================================================
--- examples/python_tests/access_rt2/query.py	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/access_rt2/query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -45,8 +45,10 @@
 for x in out[1]:
     print "%s " % x.string()
+
 out = ctxt.context_credentials()
 print "\n...final policy attribute set..."
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
+
 
 ##########################################################################
@@ -102,4 +104,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-## ctxt.dump_yap_db()
Index: examples/python_tests/access_rt2/run_test
===================================================================
--- examples/python_tests/access_rt2/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/access_rt2/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,3 +1,5 @@
 #!/bin/sh 
+
+env |grep SKIP
 
 echo '---setup principals'
@@ -19,5 +21,6 @@
 eval $g_cmd_cn 1>access.cn 2>&1
 
-result=`diff -I "Restoring file" access.cn access.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" access.cn access.save`
+
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/acme_friend_rt1/README
===================================================================
--- examples/python_tests/acme_friend_rt1/README	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/acme_friend_rt1/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -6,5 +6,5 @@
 # The policy of the Acme company is that anyone the Acme company thinks is a
 # friend of the Roadrunner is a preferred customer.  A friend of the roadrunner
-# has the [keyid:Acme}.role:friendOf([keyid:Roadrunner]) role, and a preferred
+# has the [keyid:Acme].role:friendOf([keyid:Roadrunner]) role, and a preferred
 # customer has the [keyid:Acme].role:preferred_customer role.
 #
Index: examples/python_tests/acme_friend_rt1/run_test
===================================================================
--- examples/python_tests/acme_friend_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/acme_friend_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>friend.cn 2>&1
 
-result=`diff -I "Restoring file" friend.cn friend.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" friend.cn friend.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/acme_multi_rt0/run_test
===================================================================
--- examples/python_tests/acme_multi_rt0/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/acme_multi_rt0/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -22,5 +22,5 @@
 eval $g_cmd_cn 1>multi.cn 2>&1
 
-result=`diff -I "Restoring file"  multi.cn multi.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" multi.cn multi.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/acme_rockets_intersection_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>intersect.cn 2>&1
 
-result=`diff -I "Restoring file" intersect.cn intersect.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" intersect.cn intersect.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/acme_rockets_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_rt0/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/acme_rockets_rt0/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>rocket.cn 2>&1
 
-result=`diff -I "Restoring file" rocket.cn rocket.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" rocket.cn rocket.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/alice_rt1/run_test
===================================================================
--- examples/python_tests/alice_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/alice_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>alice.cn 2>&1
 
-result=`diff -I "Restoring file" alice.cn alice.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" alice.cn alice.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/allout.save
===================================================================
--- examples/python_tests/allout.save	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/allout.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -138,6 +138,7 @@
  ==> RUN on basic_id
 ---setup principals
----run with sha
----run with cn
+---run id with sha
+---run id with cn
+---run id_ctxt with cn
    PASSED
 
@@ -154,2 +155,18 @@
 ...with cn
    PASSED
+
+ ==> RUN on alumni3_ctxt_rt1
+---setup principals
+---setup attributes
+---run queries
+...with sha
+...with cn
+   PASSED
+
+ ==> RUN on access_ctxt_rt2
+---setup principals
+---setup attributes
+---run queries
+...with sha
+...with cn
+   PASSED
Index: examples/python_tests/alumni2_rt1/run_test
===================================================================
--- examples/python_tests/alumni2_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/alumni2_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>alumni2.cn 2>&1
 
-result=`diff -I "Restoring file" alumni2.cn alumni2.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" alumni2.cn alumni2.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/alumni3_ctxt_rt1/README
===================================================================
--- examples/python_tests/alumni3_ctxt_rt1/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/alumni3_ctxt_rt1/README	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,48 @@
+#
+# This example shows the use of multiple contexts in one session. This is
+# based on alumni3_rt1, which is an example of reasoning about a role's 
+# parameters with range constraints.  There are 6 principals StateU, 
+# Bob, Mark, Maryann, Joe, and Jan.  StateU wants to establish a set of 
+# founding alum # based on the year of graduation.  On graduation each alum
+# has previously # been issued a credential parameterized with their 
+# major and graduation year. StateU sets up a policy that says that a 
+# principal is a founding alumni if they graduated in 1960, 1961, or 1963 
+# in either mathematics or psychology only.  This # policy is expressed in 
+# Credential 1.
+#
+# Credentials 2, 3, 4, 5, and 6 each assign a diploma credential to Bob (a 1961
+# mathematics degree), Mark (a 1965 mathematics degree), Joe (a 1961 zoology degree),
+# Maryann (a 1962 psychology degree), and Jan (a 1960 psychology degree)
+#
+# The query.py asks if each of these principals are favored alums, and only 
+# Bob and Jan are, in a multiple contexts scenario.
+#
+# context#A is made with credential 1, 2, 3,  context#B is duplicate from
+# context#A and then credential 4, 5, 6 are inserted. context#C is built 
+# with credential 1, 4, 5, 6. When query for favored # alums, from context#A, 
+# only Bob is, from context#B, both Bob and Jan are, and from context#C only
+# Jan should show up. 
+#
+
+# alumni3_ctxt_rt1
+
+# Credential 1
+# [keyid:stateU].role:foundingAlumni 
+#              <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']],
+#                                        [integer:?Year:[1960,1961,1963]])
+
+# Credential 2
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
+
+# Credential 3
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
+
+# Credential 4
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
+
+# Credential 5
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
+
+# Credential 6
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960]) <- [keyid:jan]
+
Index: examples/python_tests/alumni3_ctxt_rt1/attr.py
===================================================================
--- examples/python_tests/alumni3_ctxt_rt1/attr.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/alumni3_ctxt_rt1/attr.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,196 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+# retrieve principals' keyid value from local credential files
+stateUID=ABAC.ID("StateU_ID.pem")
+stateUID.id_load_privkey_file("StateU_private.pem")
+stateU=stateUID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bobID.id_load_privkey_file("Bob_private.pem")
+bob=bobID.id_keyid()
+
+markID=ABAC.ID("Mark_ID.pem")
+markID.id_load_privkey_file("Mark_private.pem")
+mark=markID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem")
+joeID.id_load_privkey_file("Joe_private.pem")
+joe=joeID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem")
+maryannID.id_load_privkey_file("Maryann_private.pem")
+maryann=maryannID.id_keyid()
+
+janID=ABAC.ID("Jan_ID.pem")
+janID.id_load_privkey_file("Jan_private.pem")
+jan=janID.id_keyid()
+
+################################################
+# Credential 1, this policy has two range constraints on different parameters
+# [keyid:stateU].role:foundingAlumni
+#              <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']],
+#                                             [integer:?Year:[1960,1961,1963]])
+head = ABAC.Role(stateU,"foundingAlumni")
+
+# initialize a string range constraint
+cond=ABAC.Constraint("string")
+
+# add specific string values to the constraint
+cond.constraint_add_string_target("'mathmatics'")
+cond.constraint_add_string_target("'psychology'")
+
+# create the parameter with the string range constraint
+param1=ABAC.DataTerm("string", "D", cond)
+
+# initialize another constratnt that is of integer type
+cond=ABAC.Constraint("integer")
+
+# add specific integer values to the constraint
+cond.constraint_add_integer_target(1960)
+cond.constraint_add_integer_target(1961)
+cond.constraint_add_integer_target(1963)
+
+# create the parameter with the integer range constraint
+param2=ABAC.DataTerm("integer", "Year", cond)
+tail = ABAC.Role(stateU,"diploma")
+
+# add the parameter with conditions to a role
+tail.role_add_data_term(param1)
+tail.role_add_data_term(param2)
+
+# build up the policy rule
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+
+# finalize the policy rule
+attr.attribute_bake()
+
+# save it to a credential file
+attr.attribute_write_cert("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# Credential 2
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
+param1=ABAC.DataTerm("string", "'mathmatics'")
+param2=ABAC.DataTerm("integer", "1961")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_m__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# Credential 3
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
+param1=ABAC.DataTerm("string", "'mathmatics'")
+param2=ABAC.DataTerm("integer", "1965")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(mark)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_m__Mark_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+#################################################
+# Credential 4
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
+param1=ABAC.DataTerm("string", "'zoology'")
+param2=ABAC.DataTerm("integer", "1961")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_z__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# Credential 5
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962])
+#                             <- [keyid:maryann]
+param1=ABAC.DataTerm("string", "'psychology'")
+param2=ABAC.DataTerm("integer", "1962")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(maryann)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_p__Maryann_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# Credential 6
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960])
+#                              <- [keyid:jan]
+param1=ABAC.DataTerm("string", "'psychology'")
+param2=ABAC.DataTerm("integer", "1960")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(jan)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_p__Jan_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+###############################
Index: examples/python_tests/alumni3_ctxt_rt1/ctxt.save
===================================================================
--- examples/python_tests/alumni3_ctxt_rt1/ctxt.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/alumni3_ctxt_rt1/ctxt.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,68 @@
+
+...ctxtA principals
+(pStateU,keyid,y) 
+(pBob,keyid,n) 
+(pMark,keyid,n) 
+
+...ctxtA attributes
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('mathmatics',1961) <- pBob
+pStateU.diploma('mathmatics',1965) <- pMark
+
+...ctxtB principals
+(pStateU,keyid,y) 
+(pBob,keyid,n) 
+(pMark,keyid,n) 
+(pJoe,keyid,n) 
+(pMaryann,keyid,n) 
+(pJan,keyid,n) 
+
+...ctxtB attributes
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('mathmatics',1961) <- pBob
+pStateU.diploma('mathmatics',1965) <- pMark
+pStateU.diploma('zoology',1961) <- pJoe
+pStateU.diploma('psychology',1962) <- pMaryann
+pStateU.diploma('psychology',1960) <- pJan
+
+...ctxtC principals
+(pStateU,keyid,y) 
+(pMaryann,keyid,n) 
+(pJan,keyid,n) 
+
+...ctxtC attributes
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('psychology',1962) <- pMaryann
+pStateU.diploma('psychology',1960) <- pJan
+
+
+===good============ ctxtA,stateU.foundingAlumni <- Bob
+YAP query succeed
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('mathmatics',1961) <- pBob
+
+
+===good============ ctxtB,stateU.foundingAlumni <- Bob
+YAP query succeed
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('mathmatics',1961) <- pBob
+
+
+===bad============ ctxtC,stateU.foundingAlumni <- Bob
+YAP query failed
+
+
+===bad============ ctxtA,stateU.foundingAlumni <- Jan
+YAP query failed
+
+
+===good============ ctxtB,stateU.foundingAlumni <- Jan
+YAP query succeed
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('psychology',1960) <- pJan
+
+
+===good============ ctxtC,stateU.foundingAlumni <- Jan
+YAP query succeed
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('psychology',1960) <- pJan
Index: examples/python_tests/alumni3_ctxt_rt1/ctxt_prover.c
===================================================================
--- examples/python_tests/alumni3_ctxt_rt1/ctxt_prover.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/alumni3_ctxt_rt1/ctxt_prover.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,129 @@
+/**
+   ctxt_prover.c
+
+gcc -g -o ctxt_prover ctxt_prover.c -L/usr/local/lib -L/usr/local/lib/ipsec -labac -lYap -lreadline -lm -lstrongswan -lpthread -Wl,-rpath -Wl,/usr/local/lib/ipsec
+
+./ctxt_prover
+env ABAC_CN=1 ./ctxt_prover
+**/
+
+#include <err.h>
+#include <stdio.h>
+#include <assert.h>
+#include <string.h>
+
+#include <abac.h>
+#include "abac_external.h"
+
+extern void abac_print_cred_info(abac_credential_t*, FILE*);
+extern void abac_print_prin_info(abac_id_credential_t*, FILE*);
+
+    /* dump credentials from context */
+void print_attrs(abac_context_t *ctxt, char *stub)
+{
+    int i;
+
+    abac_credential_t *cred=NULL;
+    abac_credential_t **credentials=NULL;
+    printf("\n\n");
+    puts("%s attrs :", stub);
+    credentials = abac_context_credentials(ctxt);
+    if (credentials != NULL) {
+        for (i = 0; credentials[i] != NULL; ++i) {
+           cred = credentials[i];
+           abac_print_typed_cred_info(cred,NULL);
+        }
+    }
+    if(credentials)
+        abac_free_credentials(credentials);
+}
+
+void print_ids(abac_context_t *ctxt, char *stub)
+{
+    int i;
+
+    abac_id_credential_t *id_cred=NULL;
+    abac_id_credential_t **id_credentials=NULL;
+    printf("\n\n");
+    puts("%s principals :", stub);
+    id_credentials = abac_context_principals(ctxt);
+    if (id_credentials != NULL) {
+        for (i = 0; id_credentials[i] != NULL; ++i) {
+           id_cred = id_credentials[i];
+           abac_print_prin_info(id_cred,NULL);
+        }
+    }
+    if(id_credentials)
+        abac_free_principals(id_credentials);
+}
+
+void query(abac_context_t *ctxt, char* who, char *what)
+{
+    abac_credential_t *cred=NULL;
+    abac_credential_t **credentials=NULL;
+    int i, success=0;
+
+    abac_aspect_t *query=abac_role_create(who,"foundingAlumni");
+    abac_aspect_t *with=abac_role_principal_create(what);
+
+    credentials = abac_context_query_with_structure(ctxt, query, with, &success);
+    if (success)
+        puts("prover success!!");
+        else puts("prover failed!!");
+
+    if (credentials != NULL && success) {
+        puts("credentials needed :");
+        for (i = 0; credentials[i] != NULL; ++i) {
+           cred = credentials[i];
+           abac_print_cred_info(cred,NULL);
+        }
+    }
+    if(credentials)
+        abac_free_credentials(credentials);
+}
+
+
+int main(int argc, char **argv)
+{
+    abac_context_t *ctxtA = abac_context_new();
+/* abac_context_load_id_files(ctxtA,"StateU_ID.pem","StateU_private.pem"); */
+    abac_id_t *id;
+    abac_id_t *stateid=abac_id_from_file("StateU_ID.pem");
+    abac_id_load_privkey_file(stateid,"StateU_private.pem");
+    char* stateU=abac_id_keyid(stateid);
+    abac_context_load_id(ctxtA, stateid);
+    
+/*  abac_context_load_id_file(ctxtA,"Bob_ID.pem"); */
+    abac_id_t *bobid=abac_id_from_file("Bob_ID.pem");
+    char* bob=abac_id_keyid(bobid);
+    abac_context_load_id(ctxtA, bobid);
+
+/*  abac_context_load_id_file(ctxtA,"Mark_ID.pem"); */
+    abac_id_t *markid=abac_id_from_file("Mark_ID.pem");
+    char* mark=abac_id_keyid(markid);
+    abac_context_load_id(ctxtA, markid);
+
+    abac_context_load_attribute_file(ctxtA,"StateU_foundingAlumni__stateU_diploma_q_qY_attr.der");
+
+    abac_context_t *ctxtB = abac_context_dup(ctxtA);
+
+/*  abac_context_load_id_file(ctxtB,"Joe_ID.pem"); */
+    abac_id_t *joeid=abac_id_from_file("Joe_ID.pem");
+    abac_context_load_id(ctxtA, joeid);
+
+/*  abac_context_load_id_file(ctxtB,"Maryann_ID.pem"); */
+    abac_id_t *maryannid=abac_id_from_file("Maryann_ID.pem");
+    abac_context_load_id(ctxtA, maryannid);
+
+/*  abac_context_load_id_file(ctxtB,"Jan_ID.pem"); */
+    abac_id_t *janid=abac_id_from_file("Jan_ID.pem");
+    abac_context_load_id(ctxtA, janid);
+
+    abac_verifier_session_dump();
+
+    query(ctxtA, stateU, bob);
+    query(ctxtB, stateU, bob);
+
+
+    return 0;
+}
Index: examples/python_tests/alumni3_ctxt_rt1/query.py
===================================================================
--- examples/python_tests/alumni3_ctxt_rt1/query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/alumni3_ctxt_rt1/query.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,135 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+##########################################
+# dump the loaded principals/policies
+#
+def dumpCred(CTXT, STRING):
+   out = CTXT.context_principals()
+   print "\n...%s principals" %STRING
+   for x in out[1]:
+       print "%s " % x.string()
+   out = CTXT.context_credentials()
+   print "\n...%s attributes" %STRING
+   for c in out[1]:
+       print "%s <- %s" % (c.head_string(), c.tail_string())
+   return 
+   
+##########################################
+# role=[keyid:stateU].role:foundingAlumni
+# p=[keyid:WHO] 
+def askAbout(CTXT, WHO, STRING):
+   print "\n%s" %STRING
+   role = ABAC.Role(stateU,"foundingAlumni")
+   p = ABAC.Role(WHO)
+   out = CTXT.query(role, p)
+   for c in out[1]:
+       print "%s <- %s" % (c.head_string(), c.tail_string())
+   return
+
+###############################
+ctxtA = ABAC.Context()
+ctxtA.set_no_partial_proof()
+
+ctxtC = ABAC.Context()
+ctxtC.set_no_partial_proof()
+###############################
+
+# retrieve principals' keyid value from local credential files
+stateUID=ABAC.ID("StateU_ID.pem")
+stateUID.id_load_privkey_file("StateU_private.pem")
+stateU=stateUID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bob=bobID.id_keyid()
+
+markID=ABAC.ID("Mark_ID.pem")
+mark=markID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem")
+joe=joeID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem")
+maryann=maryannID.id_keyid()
+
+janID=ABAC.ID("Jan_ID.pem")
+jan=janID.id_keyid()
+
+ctxtA.load_id(stateUID)
+ctxtA.load_id(bobID)
+ctxtA.load_id(markID)
+
+ctxtC.load_id(stateUID)
+
+################################################
+# Credential 1, this policy has two range constraints on different parameters
+# [keyid:stateU].role:foundingAlumni
+#              <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']],
+#                                             [integer:?Year:[1960,1961,1963]])
+ctxtA.load_attribute_file("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
+ctxtC.load_attribute_file("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
+
+#################################################
+# Credential 2
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
+ctxtA.load_attribute_file("StateU_diploma_m__Bob_attr.der")
+
+#################################################
+# Credential 3
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
+ctxtA.load_attribute_file("StateU_diploma_m__Mark_attr.der")
+
+###############################
+ctxtB = ABAC.Context(ctxtA)
+ctxtB.set_no_partial_proof()
+
+ctxtB.load_id(joeID)
+ctxtB.load_id(maryannID)
+ctxtB.load_id(janID)
+###############################
+ctxtC.load_id(maryannID)
+ctxtC.load_id(janID)
+###############################
+
+##########################################################################
+# Credential 4
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
+ctxtB.load_attribute_file("StateU_diploma_z__Joe_attr.der")
+
+#################################################
+# Credential 5
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962])
+#                             <- [keyid:maryann]
+ctxtB.load_attribute_file("StateU_diploma_p__Maryann_attr.der")
+ctxtC.load_attribute_file("StateU_diploma_p__Maryann_attr.der")
+
+#################################################
+# Credential 6
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960])
+#                              <- [keyid:jan]
+ctxtB.load_attribute_file("StateU_diploma_p__Jan_attr.der")
+ctxtC.load_attribute_file("StateU_diploma_p__Jan_attr.der")
+
+###############################
+dumpCred(ctxtA, "ctxtA")
+dumpCred(ctxtB, "ctxtB")
+dumpCred(ctxtC, "ctxtC")
+
+askAbout(ctxtA, bob, "\n===good============ ctxtA,stateU.foundingAlumni <- Bob")
+askAbout(ctxtB, bob, "\n===good============ ctxtB,stateU.foundingAlumni <- Bob")
+askAbout(ctxtC, bob, "\n===bad============ ctxtC,stateU.foundingAlumni <- Bob")
+
+askAbout(ctxtA, jan, "\n===bad============ ctxtA,stateU.foundingAlumni <- Jan")
+askAbout(ctxtB, jan, "\n===good============ ctxtB,stateU.foundingAlumni <- Jan")
+askAbout(ctxtC, jan, "\n===good============ ctxtC,stateU.foundingAlumni <- Jan")
+
Index: examples/python_tests/alumni3_ctxt_rt1/run_test
===================================================================
--- examples/python_tests/alumni3_ctxt_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/alumni3_ctxt_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,32 @@
+#!/bin/sh 
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1> ctxt.log 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > ctxt.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>ctxt.cn 2>&1
+
+result=`diff -I "Restoring file" -I "YAP 6.3" ctxt.cn ctxt.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:alumni3_ctxt_rt1 test result differs!!!"
+    fi
+else
+    echo "   ERROR:alumni3_ctxt_rt1 test result differs!!!"
+fi
+
+
Index: examples/python_tests/alumni3_ctxt_rt1/setup.py
===================================================================
--- examples/python_tests/alumni3_ctxt_rt1/setup.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/alumni3_ctxt_rt1/setup.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,37 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates many principals
+used by the example.
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+stateU=ABAC.ID("StateU", 0)
+stateU.id_write_cert("StateU_ID.pem")
+stateU.id_write_privkey("StateU_private.pem")
+
+bob=ABAC.ID("Bob", 0)
+bob.id_write_cert("Bob_ID.pem")
+bob.id_write_privkey("Bob_private.pem")
+
+mark=ABAC.ID("Mark", 0)
+mark.id_write_cert("Mark_ID.pem")
+mark.id_write_privkey("Mark_private.pem")
+
+joe=ABAC.ID("Joe", 0)
+joe.id_write_cert("Joe_ID.pem")
+joe.id_write_privkey("Joe_private.pem")
+
+maryann=ABAC.ID("Maryann", 0)
+maryann.id_write_cert("Maryann_ID.pem")
+maryann.id_write_privkey("Maryann_private.pem")
+
+jan=ABAC.ID("Jan", 0)
+jan.id_write_cert("Jan_ID.pem")
+jan.id_write_privkey("Jan_private.pem")
+
+
+
Index: examples/python_tests/alumni3_rt1/run_test
===================================================================
--- examples/python_tests/alumni3_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/alumni3_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>alumni3.cn 2>&1
 
-result=`diff -I "Restoring file" alumni3.cn alumni3.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" alumni3.cn alumni3.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/alumni_rt1/run_test
===================================================================
--- examples/python_tests/alumni_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/alumni_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>alumni.cn 2>&1
 
-result=`diff -I "Restoring file" alumni.cn alumni.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" alumni.cn alumni.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/balltime_rt2/run_test
===================================================================
--- examples/python_tests/balltime_rt2/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/balltime_rt2/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>ball.cn 2>&1
 
-result=`diff -I "Restoring file" ball.cn ball.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" ball.cn ball.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/basic_attribute/run_test
===================================================================
--- examples/python_tests/basic_attribute/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/basic_attribute/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -9,5 +9,5 @@
 eval $g_cmd_cn 1>attr.cn 2>&1
 
-result=`diff -I "Restoring file" attr.cn attr.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" attr.cn attr.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/basic_id/id.py
===================================================================
--- examples/python_tests/basic_id/id.py	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/basic_id/id.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -20,5 +20,5 @@
 if (os.environ.has_key("keystore")) :
     keystore=os.environ["keystore"]
-    ctxt.load_directory(keystore)
+#    ctxt.load_directory(keystore)
 else:
     print("keystore is not set...")
@@ -44,60 +44,63 @@
 ## case 2
 ## creating principal using ID
-nid=ABAC.ID("Jack", 0)
-print "adding -> %s(good)" % nid.id_name()
+id2=ABAC.ID("Jack2", 0)
+print "adding -> %s(good)" % id2.id_name()
 ## load principal directly with the ID, no external
 ## credential files were created
-ctxt.load_id(nid)
+ctxt.load_id(id2)
 
 ## case 3
 ## creating principal using ID
-id=ABAC.ID("Mark", 0)
-print "adding -> %s(good)" % id.id_name()
+id3=ABAC.ID("Mark", 0)
+print "adding -> %s(good)" % id3.id_name()
 ## write cert and key content to a combo file. One is appended
 ## after another
-id.id_write_privkey("Mark_IDKEY.pem")
-id.id_write_cert("Mark_IDKEY.pem")
+id3.id_write_privkey("Mark_IDKEY.pem")
+id3.id_write_cert("Mark_IDKEY.pem")
 ## load principal in with the combo file with the tandem format
-ctxt.load_id_file("Mark_IDKEY.pem")
+ctxt.load_id_file("Mark2_IDKEY.pem")
 
 ## case 4
 ## creating principal using ID
-id=ABAC.ID("John", 0)
-print "adding -> %s(good,invisible)" % id.id_name()
-id.id_write_privkey("John_other.pem")
-id.id_write_cert("John_other.pem")
+id4=ABAC.ID("John", 0)
+print "adding -> %s(good,invisible)" % id4.id_name()
+id4.id_write_cert("John_other.pem")
 ## load id without the key file
-ctxt.load_id_file("John_other.pem")
+ctxt.load_id_file("John2_other.pem")
 
 ## case 5
 ## creating principal using ID
-id=ABAC.ID("Lori", 0)
-print "adding -> %s(good,nokey)" % id.id_name()
+id5=ABAC.ID("Lori", 0)
+print "adding -> %s(good,nokey)" % id5.id_name()
 ## write just cert into the combo file
-id.id_write_cert("Lori_IDKEY.pem")
+id5.id_write_cert("Lori_IDKEY.pem")
 ##load principal from a combo file that only contains cert part
-ctxt.load_id_file("Lori_IDKEY.pem")
+ctxt.load_id_file("Lori2_IDKEY.pem")
 
 ## case 6
 ## creating principal using ID
-id=ABAC.ID("Tom", 0)
-print "adding -> %s(bad,nocert)" % id.id_name()
+id6=ABAC.ID("Tom", 0)
+print "adding -> %s(bad,nocert)" % id6.id_name()
 ## write just key into the combo file
-id.id_write_privkey("Tom_IDKEY.pem")
+id6.id_write_privkey("Tom_IDKEY.pem")
 ## load principal from combo file that only contains key part
-ctxt.load_id_file("Tom_IDKEY.pem")
+ctxt.load_id_file("Tom2_IDKEY.pem")
 
 ## case 7
 ## creating ID using chunk
-id=ABAC.ID("Tim", 0)
-chunk=id.id_cert_chunk() 
-nid=ABAC.ID_chunk(chunk)
+## this already created a Tim with private key and
+## stored in the master list
+id7=ABAC.ID("Tim", 0)
+chunk=id7.id_cert_chunk() 
+id7=ABAC.ID_chunk(chunk)
 ## load principal from new id file
-ctxt.load_id(nid)
+ctxt.load_id(id7)
 
 ## case 8
 ## load directly using chunk
-id=ABAC.ID("Stanley", 0)
-chunk=id.id_cert_chunk() 
+## this already created a Stanley with private key
+## and stored in the master list
+id8=ABAC.ID("Stanley", 0)
+chunk=id8.id_cert_chunk() 
 ## load principal as chunk
 ctxt.load_id_chunk(chunk)
@@ -115,3 +118,4 @@
 print "\n"
 
-ctxt.dump_yap_db()
+#ctxt.context_free_now(); 
+#ctxt.dump_yap_db()
Index: examples/python_tests/basic_id/id.save
===================================================================
--- examples/python_tests/basic_id/id.save	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/basic_id/id.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,15 +1,8 @@
-% Restoring file /usr/local/lib/Yap/startup.yss
-python: Couldn't load ID/KEY IDKEY cert Tom_IDKEY.pem
-ABAC version 0.2.3
+ABAC version 0.2.4
 ...initial principal set...
-(pBob,keyid,y) 
-(pJack,keyid,y) 
-(pMary,keyid,y) 
-(pLori,keyid,n) 
-(pMark,keyid,y) 
 
 
 adding -> pMary(good)
-adding -> pJack(good)
+adding -> pJack2(good)
 adding -> pMark(good)
 adding -> pJohn(good,invisible)
@@ -18,46 +11,32 @@
 adding -> Casper(bad,unknown file)
 ...final principal set...
-(pBob,keyid,y) 
-(pJack,keyid,y) 
 (pMary,keyid,y) 
-(pLori,keyid,n) 
-(pMark,keyid,y) 
-(pJack,keyid,y) 
-(pJohn,keyid,y) 
-(pTim,keyid,n) 
-(pStanley,keyid,n) 
+(pJack2,keyid,y) 
+(pMark2,keyid,y) 
+(pJohn2,keyid,n) 
+(pLori2,keyid,n) 
+(pTim,keyid,y) 
+(pStanley,keyid,y) 
 
 
-
-
-/* ========= yap db (dump_yap) */
-isType(pBob,keyid).
-isType(pJack,keyid).
-isType(pMary,keyid).
-isType(pLori,keyid).
-isType(pMark,keyid).
-isType(pJack,keyid).
-isType(pJohn,keyid).
-isType(pTim,keyid).
-isType(pStanley,keyid).
-appendL([],[]).
-appendL([B|C],A) :-
-   appendL(C,D),
-   append(B,D,A).
-append([],A,A).
-append([B|C],A,[B|D]) :-
-   append(C,A,D).
-file_search_path(library,A) :-
-   library_directory(A).
-file_search_path(commons,_) :-
-   commons_directory(_).
-file_search_path(swi,A) :-
-   current_prolog_flag(home,A).
-file_search_path(yap,A) :-
-   current_prolog_flag(home,A).
-file_search_path(system,A) :-
-   prolog_flag(host_type,A).
-file_search_path(foreign,yap('lib/Yap')).
-/* listing ok.. */
-/* ========= */
-
+/* ===== first ======== */
+  number of contexts: 2
+  number of principals: 0
+  number of attributes: 0
+/* ===== second ======== */
+  number of contexts: 2
+  number of principals: 1
+  number of attributes: 0
+/* ===== third ======== */
+  number of contexts: 2
+  number of principals: 2
+  number of attributes: 0
+context [A] 0 principals, 0 credentials
+context [B] 0 principals, 0 credentials
+adding -> pElla(good) to session
+context [A] 0 principals, 0 credentials
+context [B] 0 principals, 0 credentials
+loading -> pElla to ctxtA
+loading -> Bob to ctxtB
+context [A] 1 principals, 0 credentials
+context [B] 1 principals, 0 credentials
Index: examples/python_tests/basic_id/id_ctxt.py
===================================================================
--- examples/python_tests/basic_id/id_ctxt.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ examples/python_tests/basic_id/id_ctxt.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+
+"""
+  to test when an id gets loaded into the session
+vs when it gets loaded into a context
+
+cmd1:env keystore=`pwd` ./id_ctxt.py 
+cmd2:env ABAC_CN=1 keystore=`pwd` ./id_ctxt.py
+
+"""
+
+import os
+import ABAC
+
+def pSZ(CTXT,msg):
+   psz= CTXT.principal_count()
+   csz= CTXT.credential_count()
+   print "context [%s] %d principals, %d credentials" % (msg,psz,csz)
+
+ctxtA = ABAC.Context()
+ctxtB = ABAC.Context()
+
+ABAC.dump_debug_info("first")
+pSZ(ctxtA, "A")
+pSZ(ctxtB, "B")
+
+## creating and writing out using libabac ID
+id=ABAC.ID("Ella", 0)
+print "adding -> %s(good) to session" % id.id_name()
+id.id_write_cert("Ella_ID.pem")
+id.id_write_privkey("Ella_private.pem")
+
+ABAC.dump_debug_info("second")
+pSZ(ctxtA, "A")
+pSZ(ctxtB, "B")
+
+## load principal with id/key file pair
+## note, with this, we do not have handle on the keyid
+## to Ella but it will be in the db
+print "loading -> %s to ctxtA" % id.id_name()
+ctxtA.load_id_files("Ella_ID.pem","Ella_private.pem")
+
+print "loading -> Bob to ctxtB"
+ctxtB.load_id_files("Bob_ID.pem","Bob_private.pem")
+
+ABAC.dump_debug_info("third")
+pSZ(ctxtA, "A")
+pSZ(ctxtB, "B")
Index: examples/python_tests/basic_id/run_test
===================================================================
--- examples/python_tests/basic_id/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/basic_id/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -3,24 +3,27 @@
 g_cmd_sha=`grep "cmd1:" id.py |sed "s/cmd1://g" `
 g_cmd_cn=`grep "cmd2:" id.py |sed "s/cmd2://g" `
+g_cmd_ctxt_cn=`grep "cmd2:" id_ctxt.py |sed "s/cmd2://g" `
 
 echo '---setup principals'
 ./setup.py 1>id.log 2>&1
 
-echo '---run with sha'
+echo '---run id with sha'
 eval $g_cmd_sha 1>id.sha 2>&1
+echo '---run id with cn'
+eval $g_cmd_cn 1>id_pre.cn 2>&1
+echo '---run id_ctxt with cn'
+eval $g_cmd_ctxt_cn 1>>id_pre.cn 2>&1
 
-echo '---run with cn'
-eval $g_cmd_cn 1>id_pre.cn 2>&1
 cat id_pre.cn |sed 's/cert .*Tom_IDKEY.pem/cert Tom_IDKEY.pem/' > id.cn
 rm -rf id_pre.cn
-result=`diff -I "Restoring file" id.cn id.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" id.cn id.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
        echo "   PASSED"
     else
-       echo "   ERROR:id test result differs!!!"
+       echo "   ERROR:basic_id test result differs!!!"
     fi
 else
-    echo "   ERROR:id test result differs!!!"
+    echo "   ERROR:basic_id test result differs!!!"
 fi
 
Index: examples/python_tests/basic_id/setup.py
===================================================================
--- examples/python_tests/basic_id/setup.py	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/basic_id/setup.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -18,3 +18,16 @@
 bobID.id_write_privkey("Bob_private.pem")
 
+markID=ABAC.ID("Mark2", 0)
+markID.id_write_privkey("Mark2_IDKEY.pem")
+markID.id_write_cert("Mark2_IDKEY.pem")
 
+johnID=ABAC.ID("John2", 0)
+johnID.id_write_cert("John2_other.pem")
+
+tomID=ABAC.ID("Tom2", 0)
+tomID.id_write_privkey("Tom2_IDKEY.pem")
+
+loriID=ABAC.ID("Lori2", 0)
+loriID.id_write_cert("Lori2_IDKEY.pem")
+
+
Index: examples/python_tests/evaluator_rt1/run_test
===================================================================
--- examples/python_tests/evaluator_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/evaluator_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>evaluator.cn 2>&1
 
-result=`diff -I "Restoring file" evaluator.cn evaluator.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" evaluator.cn evaluator.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/experiment_create_rt0/run_test
===================================================================
--- examples/python_tests/experiment_create_rt0/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/experiment_create_rt0/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>experiment.cn 2>&1
 
-result=`diff -I "Restoring file" experiment.cn experiment.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" experiment.cn experiment.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/experiment_multi_rt0/run_test
===================================================================
--- examples/python_tests/experiment_multi_rt0/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/experiment_multi_rt0/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>experiment.cn 2>&1
 
-result=`diff -I "Restoring file" experiment.cn experiment.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" experiment.cn experiment.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/file_read_rt2/run_test
===================================================================
--- examples/python_tests/file_read_rt2/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/file_read_rt2/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>file.cn 2>&1
 
-result=`diff -I "Restoring file" file.cn file.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" file.cn file.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/fruits_rt2/fruit.save
===================================================================
--- examples/python_tests/fruits_rt2/fruit.save	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/fruits_rt2/fruit.save	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,3 +1,2 @@
-% Restoring file /usr/local/lib/Yap/startup.yss
 
 ...final principal set...
Index: examples/python_tests/fruits_rt2/run_test
===================================================================
--- examples/python_tests/fruits_rt2/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/fruits_rt2/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>fruit.cn 2>&1
 
-result=`diff -I "Restoring file" fruit.cn fruit.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" fruit.cn fruit.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/leader_rt1/run_test
===================================================================
--- examples/python_tests/leader_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/leader_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>leader.cn 2>&1
 
-result=`diff -I "Restoring file" leader.cn leader.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" leader.cn leader.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/partial_proof_rt1/run_test
===================================================================
--- examples/python_tests/partial_proof_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/partial_proof_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -17,5 +17,5 @@
 eval $g_cmd_cn 1>rocket.cn 2>&1
 
-result=`diff -I "Restoring file" rocket.cn rocket.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" rocket.cn rocket.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
Index: examples/python_tests/payraise_rt1/attr.py
===================================================================
--- examples/python_tests/payraise_rt1/attr.py	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/payraise_rt1/attr.py	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -56,10 +56,10 @@
 #               linked role
 # [keyid:alpha].role:payRaise <-
-#      [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
-#      [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
+#      [keyid:alpha].role:evaluatorOf([?this]).role:goodPerformance &
+#      [keyid:alpha].role:managerOf([?this]).role:niceCoworker
 head=ABAC.Role(alpha,"payRaise")
 
 # build a data term with ?This
-param=ABAC.DataTerm("principal", "This")
+param=ABAC.DataTerm("This")
 tail1 = ABAC.Role(alpha,"evaluatorOf","goodPerformance")
 
@@ -68,5 +68,5 @@
 
 # build another data term with ?This
-param=ABAC.DataTerm("principal", "This")
+param=ABAC.DataTerm("This")
 tail2 = ABAC.Role(alpha,"managerOf","niceCoworker")
 
Index: examples/python_tests/payraise_rt1/run_test
===================================================================
--- examples/python_tests/payraise_rt1/run_test	(revision 46df1bccf39ae760708f33fb41ec1819bdc1fde2)
+++ examples/python_tests/payraise_rt1/run_test	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -19,5 +19,5 @@
 eval $g_cmd_cn 1>pay.cn 2>&1
 
-result=`diff -I "Restoring file" pay.cn pay.save 2>/dev/null`
+result=`diff -I "Restoring file" -I "YAP 6.3" pay.cn pay.save 2>/dev/null`
 if [ $? -eq 0 ]; then
     if [ "$result" = "" ]; then
