Index: doc/INSTALL
===================================================================
--- doc/INSTALL	(revision 3f8f00f0248a2e5598e2fd6c04835f2234570d08)
+++ doc/INSTALL	(revision 38f1f308c9cb0cc4b266f702c8b2aef8890fc774)
@@ -1,5 +1,15 @@
 For Java installation instructions, see doc/java_install.
 
-Prior to building libabac you must install libstrongswan.
+Prior to building libabac 
+   you may need to install flex, bison, and GNU readline library
+   you must install YAP and libstrongswan
+
+Download yap-6.2.2 from www.dcc.fc.up.pt
+    http://www.dcc.fc.up.pt/~vsc/Yap/yap-6.2.2.tar.gz
+
+$./configure --enable-dynamic-loading
+$make
+$make library
+$sudo make install_library
 
 Download strongswan-4.4.0 from strongswan.org:
Index: doc/creddy.1
===================================================================
--- doc/creddy.1	(revision 3f8f00f0248a2e5598e2fd6c04835f2234570d08)
+++ doc/creddy.1	(revision 38f1f308c9cb0cc4b266f702c8b2aef8890fc774)
@@ -56,5 +56,5 @@
 generate an X.509 attribute cert representing an ABAC credential
 
-An attribute cert has one or more subjects. A single subject may be defined without a role. Otherwise, subjects are defined by a pair of a --subject-{cert,id} and --subject-role. Providing multiple subjects creates an intersection certificate.
+An attribute cert has one or more subjects. A single subject may be defined without a role or oset. Otherwise, subjects are defined by a pair of a --subject-{cert,id} and --subject-{role,osetj} or just --subject-obj or --subject-cert. Providing multiple subjects creates an intersection certificate.
 
 .TP
@@ -71,4 +71,8 @@
 
 .TP
+.B --oset
+o-set in issuer's local attribute space
+
+.TP
 .B --subject-cert
 X.509 identity cert representing the principal to which the role is being issued. This fulfills the same purpose as --subject-id and should only be used once per subject.
@@ -83,4 +87,12 @@
 
 .TP
+.B --subject-oset
+optional oset in subject's local attribute space. If the issuer is A, role is o1, subject is B, and subject-o2 is r2, the attribute issued will be A.o1 <- B.o2.
+
+.TP
+.B --subject-obj
+optional object in subject's local attribute space. If the issuer is A, oset is o1, and subject-obj is o2, the attribute issued will be A.o1 <- o2.
+
+.TP
 .B --validity
 optional certificate validity. This argument takes a time period followed by an optional suffix of s m h d y (defaults to d if omitted). The default is 365 days.
@@ -93,4 +105,7 @@
 .SS --roles
 Extract the roles from an X.509 attribute cert
+
+.SS --osets
+Extract the osets from an X.509 attribute cert
 
 .TP
@@ -109,4 +124,5 @@
     validity    validity period
     roles       attribute cert roles (fails silently on ID certs)
+    osets       attribute cert osets (fails silently on ID certs)
     all         all of the above
 
Index: doc/dependencies
===================================================================
--- doc/dependencies	(revision 3f8f00f0248a2e5598e2fd6c04835f2234570d08)
+++ doc/dependencies	(revision 38f1f308c9cb0cc4b266f702c8b2aef8890fc774)
@@ -11,12 +11,24 @@
         http://sourceforge.net/projects/swig/files/swig/swig-1.3.40/
 
-Perl modules (via CPAN or distribution package)
+Perl modules: (via CPAN or distribution package)
     IO::Socket::SSL
     HTTP::Daemon::SSL
     RPC::XML
 
-Python modules
+Python modules:
     m2crypto
 
+GNU Readline library:
+    readline-6.2
+
+YAP 6.2.2 Prolog system:
+    http://www.dcc.fc.up.pt/~vsc/Yap/yap-6.2.2.tar.gz
+    (configure with --enable-dynamic-loading) 
+
+Flex:
+    http://sourceforge.net/projects/flex/files/flex/flex-2.5.35/flex-2.5.35.tar.gz
+
+GNU Bison:
+    http://ftp.gnu.org/gnu/bison/
 
 BUILDING ON UBUNTU
Index: doc/design
===================================================================
--- doc/design	(revision 3f8f00f0248a2e5598e2fd6c04835f2234570d08)
+++ doc/design	(revision 38f1f308c9cb0cc4b266f702c8b2aef8890fc774)
@@ -10,18 +10,27 @@
     - create a context
     - load some certificates
-    - clone the context
     - add more certificates, possibly presented by another party
     - make a query 'does principal B have the role A.r1?'
+         or a query 'is object B part of the oset A.o1?' 
 
 CREDENTIAL
 
-An ABAC credential is the most basic unit of an ABAC proof. It is a
-signed assertion by a principal A that some other entity has a role r1.
-Abstractly, it is one of the following (A and B principls, r1, r2, r3
-roles):
+An ABAC credential is the most basic unit of an ABAC proof. 
+
+It is a signed assertion by a principal A that some other entity has a 
+role r1.  Abstractly, it is one of the following (A, B principals;
+r1, r2, r3 roles):
 
     A.r1 <- B
     A.r1 <- B.r2
     A.r1 <- B.r2.r3
+
+It is a signed assertion by a principal A that some other entity is
+an object of oset o1. (A, B principals; r1 role; o1, o2 osets; O object):
+
+    A.o1 <- O
+    A.o1 <- B.o2
+    A.o1 <- B.r1.o2
+
 
 When interacting with libabac, a credential is represented by an X509
@@ -54,8 +63,24 @@
 [Li03rt].
 
+OSET
+
+ABAC osets are the atomic units that form the head and tail of a
+credential. The head will always be a proper oset, which is to say it
+takes form:
+
+    A.o1
+
+As seen in the CREDENTIAL section, the tail of a oset can take one of
+three forms:
+
+    object:         O 
+    oset:           B.o2
+    linking oset:   B.r2.o3
+
+
 CONTEXT
 
 An ABAC context object encapsulates a set of ABAC credentials and its
-associated proof graph. The context supports the following operations:
+associated YAP clause db. The context supports the following operations:
 
     - load X509 identity certificate
@@ -63,5 +88,4 @@
     - list all the credentials (attribute identity certificate pairs)
     - query whether a principal has a given role
-    - duplicate context
 
 REFERENCES
@@ -73,4 +97,6 @@
     Press, 201­212.
 
+
+
 http://groups.geni.net/geni/wiki/TIEDABACModel
 
Index: doc/role_names
===================================================================
--- doc/role_names	(revision 3f8f00f0248a2e5598e2fd6c04835f2234570d08)
+++ doc/role_names	(revision 38f1f308c9cb0cc4b266f702c8b2aef8890fc774)
@@ -7,5 +7,5 @@
     _       [underscore]
 
-A role name must begin with a letter or digit (A-z, a-z, 0-9).
+A role name must begin with a lower case letter (a-z)
 
 There is no limit on the length of a role name.
Index: doc/usage_scenario
===================================================================
--- doc/usage_scenario	(revision 3f8f00f0248a2e5598e2fd6c04835f2234570d08)
+++ doc/usage_scenario	(revision 38f1f308c9cb0cc4b266f702c8b2aef8890fc774)
@@ -17,5 +17,5 @@
 The Coyote will begin an SSL session to your service using his
 self-signed X509 identity certificate and will present this X509
-attribute certificate in the body of his message. You will clone the
+attribute certificate in the body of his message. You will create the
 ABAC context and add the Coyote's identity certificate and the attribute
 certificate asserting that he is a preferred customer.
