Index: libabac/abac.hh
===================================================================
--- libabac/abac.hh	(revision 6e8997e69048fe15cda1e797b99fe0d409efe68b)
+++ libabac/abac.hh	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
@@ -12,4 +12,5 @@
     class Role;
     class Oset;
+
 /*** 
 ABAC::Constraint
@@ -42,10 +43,10 @@
      constructor that takes a constraining role
        [role:?R[{role-constraint}]
+     (c:abac_constraint_from_role)
 f  Constraint(Oset &)
      constructor that takes a constraining oset
        [oset:?O[{oset-constraint}]
        [urn:?F[keyid:$alpha_keyid].oset:documents([string:?P])]
-f  Constraint(abac_condition_t *)
-     constructor that takes an abac_condition_t structure
+     (c:abac_constraint_from_oset)
 f  Constraint(char *)
      constructor that takes one of following string
@@ -59,90 +60,90 @@
      it should be followed with one or many of following utility
      calls.
+     (C:abac_condition_create)
 ***/
             Constraint(Role& role);
             Constraint(Oset& oset);
+            Constraint(char *vartype)
+            { m_constraint=abac_condition_create(vartype); }
+/*ii**
+f  Constraint(abac_condition_t *)
+     internal constructor that takes an abac_condition_t structure
+**ii*/
             Constraint(abac_condition_t *constraint):
               m_constraint(abac_condition_dup(constraint))
             { }
-            Constraint(char *vartype) { 
-              m_constraint=abac_condition_create(vartype);
-            }
-/***
-f  void add_constraint_integer_max(int)
-   void add_constraint_integer_min(int)
+/***
+f  void constraint_add_integer_max(int)
+     (c:abac_constraint_add_integer_max)
+   void constraint_add_integer_min(int)
      utility routines to setup a integer range constraint 
        [integer:?I[10 .. 20]]
-f  void add_constraint_integer_target(int)
+     (c:abac_constraint_add_integer_min)
+f  void constraint_add_integer_target(int)
      utility routine to setup a integer list constraint 
        [integer:?I[10,20]]
-***/
-            void add_constraint_integer_max(int val) {
-              abac_condition_add_range_integer_item(m_constraint,abac_max_item_type(),val);
-            }
-            void add_constraint_integer_min(int val) {
-              abac_condition_add_range_integer_item(m_constraint,abac_min_item_type(),val);
-            }
-            void add_constraint_integer_target(int val) {
-              abac_condition_add_range_integer_item(m_constraint,abac_target_item_type(),val);
-            }
-/***
-f  void add_constraint_float_max(float)
-   void add_constraint_float_min(float)
+     (c:abac_constraint_add_integer_target)
+***/
+            void constraint_add_integer_max(int val)
+            { abac_constraint_add_integer_max(m_constraint,val); }
+            void constraint_add_integer_min(int val)
+            { abac_constraint_add_integer_min(m_constraint,val); }
+            void constraint_add_integer_target(int val) 
+            { abac_constraint_add_integer_target(m_constraint,val); }
+/***
+f  void constraint_add_float_max(float)
+   void constraint_add_float_min(float)
      utility routines to setup a float range constraint 
        [float:?F[1.0 .. 2.5]]
-f  void add_constraint_float_target(float)
+f  void constraint_add_float_target(float)
      utility routine to setup a float list constraint 
        [float:?F[0.5, 2.5]]
 ***/
-            void add_constraint_float_max(float val) {
-              abac_condition_add_range_float_item(m_constraint,abac_max_item_type(),val);
-            }
-            void add_constraint_float_min(float val) {
-              abac_condition_add_range_float_item(m_constraint,abac_min_item_type(),val);
-            }
-            void add_constraint_float_target(float val) {
-              abac_condition_add_range_float_item(m_constraint,abac_target_item_type(),val);
-            }
-/***
-f  void add_constraint_time_max(char*)
-   void add_constraint_time_min(char*)
+            void constraint_add_float_max(float val) 
+            { abac_constraint_add_float_max(m_constraint,val); }
+            void constraint_add_float_min(float val)
+            { abac_constraint_add_float_min(m_constraint,val); }
+            void constraint_add_float_target(float val) 
+            { abac_constraint_add_float_target(m_constraint,val); }
+/***
+f  void constraint_add_time_max(char*)
+   void constraint_add_time_min(char*)
      utility routines to setup a time range constraint, 
      takes quoted string values, beyond T is optional 
        [time:?F["20120228T" .. "20120228T090000"]]
-f  void add_constraint_time_target(char*)
+f  void constraint_add_time_target(char*)
      utility routine to setup a time list constraint 
        [time:?M["20201101T182930","20201101T"]] 
 ***/
-            void add_constraint_time_max(char* val) {
-              abac_condition_add_range_time_item(m_constraint,abac_max_item_type(),val);
-            }
-            void add_constraint_time_min(char* val) {
-                abac_condition_add_range_time_item(m_constraint,abac_min_item_type(),val);
-            }
-            void add_constraint_time_target(char* val) {
-                abac_condition_add_range_time_item(m_constraint,abac_target_item_type(),val);
-            }
-/***
-f  void add_constraint_urn_target(char*)
+            void constraint_add_time_max(char* val) 
+            { abac_constraint_add_time_max(m_constraint,val); }
+            void constraint_add_time_min(char* val)
+            { abac_constraint_add_time_min(m_constraint,val); }
+            void constraint_add_time_target(char* val) 
+            { abac_constraint_add_time_target(m_constraint,val); }
+/***
+f  void constraint_add_urn_target(char*)
      utility routine to setup a an urn list constraint
        [urn:?U["fileA","http://fileB"]] 
-f  void add_constraint_string_target(char*)
+f  void constraint_add_string_target(char*)
      utility routine to setup a a string list constraint
        [string:?S["abc",'efg',"hij"]]
-f  void add_constraint_boolean_target(char*)
+f  void constraint_add_boolean_target(char*)
      utility routine to setup a a boolean list constraint
        [boolean:?B['true']]
 ***/
-            void add_constraint_urn_target(char* val) 
-            { abac_condition_add_range_urn_item(m_constraint,val); }
-            void add_constraint_string_target(char* val)
-            { abac_condition_add_range_string_item(m_constraint,val); }
-            void add_constraint_boolean_target(char* val)
-            { abac_condition_add_range_boolean_item(m_constraint,val); }
+            void constraint_add_urn_target(char* val) 
+            { abac_constraint_add_urn_target(m_constraint,val); }
+            void constraint_add_string_target(char* val)
+            { abac_constraint_add_string_target(m_constraint,val); }
+            void constraint_add_boolean_target(char* val)
+            { abac_constraint_add_boolean_target(m_constraint,val); }
 /***
 f  char *string() const
      returns literal string of the constraint
+     (c:abac_condition_string)
 f  char *typed_string() const
      returns typed literal string of the constraint
+     (c:abac_condition_typed_string)
 ***/
             char *string() const 
@@ -150,8 +151,8 @@
             char *typed_string() const 
             { return abac_condition_typed_string(m_constraint); }
-/***
+/*ii**
 f  abac_condition_t *constraint()
-     returns internal constraint structure
-***/
+     internal returns internal constraint structure
+**ii*/
             abac_condition_t *constraint()
             { return m_constraint; }
@@ -181,54 +182,45 @@
             DataTerm() : m_term(NULL) { } // do not use: here for swig
             DataTerm(const DataTerm &dterm) { 
-              m_term =abac_term_dup(dterm.m_term);
-              abac_condition_t *constraint=abac_term_constraint(m_term);
-              if(constraint) m_cond=new Constraint(constraint);
-                else m_cond=NULL;
+              m_term=abac_term_dup(dterm.m_term);
             }
             ~DataTerm() { 
               if(m_term) abac_term_free(m_term);
-              if(m_cond) free(m_cond);
-            }
-/*** ???
+            }
+/*ii** 
 f  DataTerm(abac_term_t *)
-     constructor to make data term from abac_term_t structure
-***/
-            DataTerm(abac_term_t *term) { 
-              m_term=abac_term_dup(term);
-              abac_condition_t *constraint=abac_term_constraint(m_term);
-              if(constraint) m_cond=new Constraint(constraint);
-                else m_cond=NULL;
-            }
+     internal constructor to make data term from abac_term_t structure
+**ii*/
+            DataTerm(abac_term_t *term)
+            { m_term=abac_term_dup(term); }
 /***
 f  DataTerm(char*)
      constructor to make named principal data term for the oset RHS 
+     (C: abac_term_named_create)
 f  DataTerm(char*, char*, Constraint*)
-     constructor for making a variable data term or an instantiated
-     data term
+     constructor for making a variable data term 
+     (C: abac_term_create)
+f  DataTerm(char*, char*)
+     constructor for making an instantiated data term
+     (C: abac_term_create)
 ***/
             DataTerm(char *sha) {
               if(debug) printf("adding a Dataterm named principal(%s)\n",sha);
-              int isnamed=1;
-              int type=e_TERM_PRINCIPAL;
-              m_term=abac_term_named_create(type,sha);
-            }
-            DataTerm(char* typenm, char *name, Constraint *cond=NULL) {
-              int type=abac_verify_term_type(typenm);
+              m_term=abac_term_named_create(sha);
+            }
+            DataTerm(char* typenm, char *name, Constraint *cond) {
               if(debug) printf("adding a Dataterm (%s)\n",name);
-              if(type==ABAC_TERM_FAIL)
-                abac_errx(1, "DataTerm, fail to create the term");
-              if(cond) {
-                m_cond=cond;
-                m_term=abac_term_create(type,name,cond->constraint());
-                } else {
-                  m_cond=NULL;
-                  m_term=abac_term_create(type,name,NULL);
-              }
+              m_term=abac_term_create(typenm,name,cond->constraint());
+            }
+            DataTerm(char* typenm, char *name) {
+              if(debug) printf("adding a Dataterm (%s)\n",name);
+              m_term=abac_term_create(typenm,name,NULL);
             }
 /***
 f  char *string() const
      returns literal string of the data term
+     (c:abac_term_string)
 f  char *typed_string() const
      returns typed literal string of the data term
+     (c:abac_term_typed_string)
 ***/
             char *string() const
@@ -237,54 +229,44 @@
             { return abac_term_typed_string(m_term); }
 /***
-f  bool is_time() const
-   bool is_string() const
-   bool is_urn() const
-   bool is_integer() const 
+f  bool term_is_time() const
+   bool term_is_string() const
+   bool term_is_urn() const
+   bool term_is_integer() const 
      returns true if data term is of certain type
 ***/
-            bool is_time() const 
-            { return abac_term_is_time_type(m_term); }
-            bool is_string() const
-            { return abac_term_is_string_type(m_term); }
-            bool is_urn() const
-            { return abac_term_is_urn_type(m_term); }
-            bool is_integer() const 
-            { return abac_term_is_integer_type(m_term); }
-/***
-f  int add_constraint(const Contraint&)
+            bool term_is_time() const 
+            { return abac_term_is_time(m_term); }
+            bool term_is_string() const
+            { return abac_term_is_string(m_term); }
+            bool term_is_urn() const
+            { return abac_term_is_urn(m_term); }
+            bool term_is_integer() const 
+            { return abac_term_is_integer(m_term); }
+/***
+f  int term_add_constraint(Contraint&)
      utiltiy routine to add a constraint to this data term
 ***/
-            int add_constraint(const Constraint& cond) {
-              m_cond=new Constraint(cond);
-              abac_term_add_constraint(m_term, m_cond->constraint());
-            }
-/***
-f  int type() const
+            int term_add_constraint(Constraint& cond) {
+              abac_term_add_constraint(m_term, cond.constraint());
+              return 1;
+            }
+/***
+f  int term_type() const
      returns subtype of the data term
-f  char *name() const
+f  char *term_name() const
      returns the name of the data term 
 ***/
-            int type() const 
+            int term_type() const 
             { abac_term_type(m_term); }
-            char *name() const 
+            char *term_name() const 
             { return abac_term_name(m_term); }
-/*** ??? value 
-f  char *value() const
-     Not implemented
-***/
-            char *value() const { }
-/***
+/*ii**
 f  abac_term_t *term()
-     returns internal data term structure
-f  Constraint *constraint()
-     returns internal constraint structure to the data term
-***/
+     returns abac_term_t term structure
+**ii*/
             abac_term_t *term() 
             { return m_term; }
-            Constraint *constraint()
-            { return m_cond; }
         private:
             abac_term_t *m_term;
-            Constraint *m_cond;
     };
 
@@ -311,31 +293,35 @@
               if (m_role) abac_aspect_free(m_role);
             }
-/***
+/*ii**
 f  Role(abac_aspect_t*)
      constructor that takes an abac_aspect_t structure
+**ii*/
+            Role(abac_aspect_t *role): m_role(abac_aspect_dup(role))
+            { }
+/***
 f  Role(char*) 
      constructor that builds a bare bone role with just principal's name
+     (c:abac_role_principal_create)
 f  Role(char*, char*) 
      constructor that builds a bare bone role with just principal's name
      and a role name
-***/
-            Role(abac_aspect_t *role): m_role(abac_aspect_dup(role))
-            { }
+     (c:abac_role_create)
+***/
             Role(char *principal_name) : 
-               m_role(abac_aspect_role_principal_create(principal_name)) 
+               m_role(abac_role_principal_create(principal_name)) 
             { }
             Role(char *principal_name, char *role_name) : 
-               m_role(abac_aspect_role_create(principal_name, role_name)) 
+               m_role(abac_role_create(principal_name, role_name)) 
             { }
 /***
-f  bool is_principal() const
+f  bool role_is_principal() const
      return true if the role is a principal object(made from
      a data term), the right hand side of, 
        [keyid:A].role:r <- [keyid:B]
 ***/
-            bool is_principal() const
-            { return abac_aspect_is_principal(m_role); }
-/***
-f  bool is_linking() const
+            bool role_is_principal() const
+            { return abac_role_is_principal(m_role); }
+/***
+f  bool role_is_linking() const
      returns true if the role is a linking role like
      the right hand side of,
@@ -343,10 +329,12 @@
 ***/
             bool is_linking() const
-            { return abac_aspect_is_linking(m_role); }
+            { return abac_role_is_linking(m_role); }
 /***
 f  char *string() const
      returns literal string of the role
+     (c:abac_aspect_string)
 f  char *typed_string() const
      returns typed literal string of the role
+     (c:abac_aspect_typed_string)
 ***/
             char *string() const
@@ -355,10 +343,10 @@
             { return abac_aspect_typed_string(m_role); }
 /***
-f  char *linked_role() const 
+f  char *role_linked_role() const 
      returns linked part of a linking role, for
        [keyid:A].role:r1.role:r2, it returns r1
 ***/
-            char *linked_role() const 
-            { return abac_aspect_linked_role_name(m_role); }
+            char *role_linked_role() const 
+            { return abac_role_linked_role(m_role); }
 /***
 f  char *role_name() const 
@@ -366,22 +354,23 @@
        [keyid:A].role.r1.role:r2, it returns r2
        [keyid:A].role.r1, it returns r1
+f  char *role_principal() const
+     returns the principal of role (the part before the first dot)
+       [keyid:A].role.r1, it returns A 
 ***/
             char *role_name() const
-            { return abac_aspect_aspect_name(m_role); }
-            char *principal() const
-            { return abac_aspect_principal_name(m_role); }
-
-/***
-f  int add_data_term(DataTerm&)
+            { return abac_role_name(m_role); }
+            char *role_principal() const
+            { return abac_role_principal(m_role); }
+
+/***
+f  void role_add_data_term(DataTerm&)
      add a data term to the role
 ***/
-            int add_data_term(DataTerm& d) {
-              abac_aspect_add_param(m_role, d.term());
-              return 1;
+            void role_add_data_term(DataTerm& d) {
+              abac_role_add_data_term(m_role, d.term());
             }
 /***
 f  std::vector<DataTerm> get_data_terms(bool &)
      return the data terms bound to this role.
-     ??? If the role is returned in a proof, these will all have values.
 ***/
             std::vector<DataTerm> get_data_terms(bool &success) {
@@ -397,12 +386,14 @@
               return dataterms;
             }
-            int add_linking_data_term(DataTerm& d) {
-              abac_aspect_add_linked_param(m_role, d.term());
-              return 1;
+/***
+f  void role_add_linked_data_term(DataTerm&)
+     add a data term to the linking role
+***/
+            void role_add_linked_data_term(DataTerm& d) {
+              abac_role_add_linked_data_term(m_role, d.term());
             }
 /***
 f  std::vector<DataTerm> get_linked_data_terms(bool &)
      return the data terms bound to this role's linking role.
-     ??? If the role is returned in a proof, these will all have values.
 ***/
             std::vector<DataTerm> get_linked_data_terms(bool &success) {
@@ -418,8 +409,8 @@
               return dataterms;
             }
-/***
+/*ii**
 f  abac_aspect_t *role()
      returns the interal libabac representation of this role
-***/
+**ii*/
             abac_aspect_t *role() {return m_role;}
         private:
@@ -446,52 +437,58 @@
             ~Oset()
             { if(m_oset) abac_aspect_free(m_oset); }
-/***
+/*ii**
 f  Oset(abac_aspect_t *)
      constructor that takes abac_aspect_t structure
+**ii*/
+            Oset(abac_aspect_t *oset): m_oset(abac_aspect_dup(oset)) 
+            { }
+/***
 f  Oset(char *)
      constructor that makes a principal oset, ie [keyid:B]
+     (c:abac_role_principal_create)
 f  Oset(char *, char *)
      constructor that makes a regular oset, ie. [keyid:B].oset:o
+     (c:abac_role_create)
 f  Oset(DataTerm&)
      constructor that makes an object oset, ie. [urn:'file/fileA']
 ***/
-            Oset(abac_aspect_t *oset): m_oset(abac_aspect_dup(oset)) 
-            { }
-            Oset(char *oset_name) : m_oset(abac_aspect_oset_principal_create(oset_name)) 
+            Oset(char *oset_name) : m_oset(abac_oset_principal_create(oset_name)) 
             { }
             Oset(char *principal_name, char *oset_name) : 
-               m_oset(abac_aspect_oset_create(principal_name, oset_name)) 
+               m_oset(abac_oset_create(principal_name, oset_name)) 
             { }
             Oset(DataTerm& d) :
-               m_oset(abac_aspect_oset_object_create(d.term())) 
+               m_oset(abac_oset_object_create(d.term())) 
             { }
 
 /***
-f  bool is_object(), ie <- [integer:10]
+f  bool oset_is_object(), ie <- [integer:10]
      return ture if this oset is an object oset
 ***/
-            bool is_object() const
-            { return abac_aspect_is_object(m_oset); }
-/***
-f  bool is_principal() const
+            bool oset_is_object() const
+            { return abac_oset_is_object(m_oset); }
+/***
+f  bool oset_is_principal() const
      return true if the oset is a principal object(made from
      a data term), the right hand side of, 
        [keyid:A].oset:o <- [keyid:B]
 ***/
-            bool is_principal() const 
-            { return abac_aspect_is_principal(m_oset); }
-/***
-f  bool is_linking() const
+            bool oset_is_principal() const 
+            { return abac_oset_is_principal(m_oset); }
+/***
+f  bool oset_is_linking() const
      returns true if the oset is a linking oset like
      the right hand side of,
        [keyid:A].oset:o1 <- [keyid:B].role:r1.oset:o2
 ***/
-            bool is_linking() const 
-            { return abac_aspect_is_linking(m_oset); }
+            bool oset_is_linking() const 
+            { return abac_oset_is_linking(m_oset); }
 /***
 f  char *string() const
      returns literal string of the oset
+     (c:abac_aspect_string)
 f  char *typed_string() const
      returns typed literal string of the oset
+     (c:abac_aspect_typed_string)
 ***/
             char *string() const
@@ -500,10 +497,10 @@
             { return abac_aspect_typed_string(m_oset); }
 /***
-f  char *linked_role() const 
+f  char *oset_linked_role() const 
      returns linked part of a linking oset, for
        [keyid:A].role:r1.oset:o1, it returns r1
 ***/
-            char *linked_role() const 
-            { return abac_aspect_linked_role_name(m_oset); }
+            char *oset_linked_role() const 
+            { return abac_oset_linked_role(m_oset); }
 /***
 f  char *oset_name() const 
@@ -513,32 +510,29 @@
 ***/
             char *oset_name() const
-            { return abac_aspect_aspect_name(m_oset); }
-/***
-f  char *principal() const 
+            { return abac_oset_name(m_oset); }
+/***
+f  char *oset_principal() const 
      returns principal name,
        [keyid:A].role:r1.oset:o1, it returns A 
 ***/
-            char *principal() const
-            { return abac_aspect_principal_name(m_oset); }
-/***
-f  char *object() const 
+            char *oset_principal() const
+            { return abac_oset_principal(m_oset); }
+/***
+f  char *oset_object() const 
      returns object's name when the oset is a principal object
        [keyid:A].oset:values <- [integer:10], it returns 10
 ***/
-            char *object() const 
-            { return abac_aspect_object_name(m_oset); }
-/***
-f  int add_data_term(DataTerm&)
+            char *oset_object() const 
+            { return abac_oset_object(m_oset); }
+/***
+f  void add_data_term(DataTerm&)
      add a data term to this oset's parameter set
-     always returns 1
-***/
-            int add_data_term(DataTerm& d) {
-              abac_aspect_add_param(m_oset, d.term()); 
-              return 1;
+***/
+            void oset_add_data_term(DataTerm& d) {
+              abac_oset_add_data_term(m_oset, d.term()); 
             }
 /***
 f  std::vector<DataTerm> get_data_terms(bool &)
      returns the data terms bound to this oset.  
-     ??? If the oset is returned in a proof, these will all have values.
 ***/
             std::vector<DataTerm> get_data_terms(bool &success) {
@@ -555,16 +549,13 @@
             }
 /***
-f  int add_linking_data_term(DataTerm&)
+f  void oset_add_linked_data_term(DataTerm&)
      add a data term to this oset's linking role's parameter set.
-     always returns 1
-***/
-            int add_linking_data_term(DataTerm& d) {
-              abac_aspect_add_linked_param(m_oset, d.term());
-              return 1;
+***/
+            void oset_add_linked_data_term(DataTerm& d) {
+              abac_oset_add_linked_data_term(m_oset, d.term());
             }
 /***
 f  std::vector<DataTerm> get_linked_data_terms(bool &)
      returns the data terms bound to this oset's linking role.  
-     ??? If the oset is returned in a proof, these will all have values.
 ***/
             std::vector<DataTerm> get_linked_data_terms(bool &success) {
@@ -580,8 +571,8 @@
               return dataterms;
             }
-/***
+/*ii**
 f  abac_aspect_t *oset()
-     returns the internal libabac representation of the oset
-***/
+     internal returns the internal libabac representation of the oset
+**ii*/
             abac_aspect_t *oset() {return m_oset;}
         private:
@@ -609,10 +600,10 @@
             ID(const ID &id) { m_id =abac_id_dup(id.m_id); }
             ~ID() { if(m_id) abac_id_free(m_id); }
-/*** ???
+/*ii**
 f  ID(abac_id_t *)
      constructor from abac_id_t
 f  ID(abac_id_credential_t *)
      constructor from abac_id_t
-***/
+**ii*/
             ID(abac_id_t *id): m_id(abac_id_dup(id)) 
             { }
@@ -622,9 +613,9 @@
               else m_id=NULL;
             }
-
 /*** 
 f  ID(char *)
      load an ID cert from a file, will throw an exception 
      if the cert cannot be loaded 
+     (c:abac_id_from_file)
 ***/
             ID(char *filename) {
@@ -639,4 +630,5 @@
      - validity must be at least one second
      will throw an exception if either of the above is violated 
+     (c:abac_id_generate)
 ***/
             ID(char *cn, int validity) {
@@ -646,86 +638,83 @@
             }
 /*** 
-f  void load_privkey(char *)
+f  void id_load_privkey_file(char *)
      loads the private key associated with the ID credential
      will throw an exception if the key cannot be loaded 
 ***/
-            void load_privkey(char *filename) {
+            void id_load_privkey_file(char *filename) {
               int rt=abac_id_load_privkey_file(m_id, filename);
               if(rt != 1) 
                 abac_errx(1, "Failed to load private key");
             }
-/***
+/*ii**
 f  abac_id_t *id()
      returns the abac_id_t 
      returns the interal libabac representation of this id
-***/
+**ii*/
             abac_id_t *id() { return m_id; }
 
 /***
-f  char *keyid()
+f  char *id_keyid()
      returns the SHA1 keyid of the id cert
-f  char *name()
+f  char *id_name()
      returns the CN (the parameter passed to the constructor or the
      CN of the cert).
-***/
-            char *keyid() { return abac_id_keyid(m_id); }
-            char *name() { return abac_id_cn(m_id); }
-/***
-f  bool has_privkey()
+     (c:abac_id_cn)
+***/
+            char *id_keyid() { return abac_id_keyid(m_id); }
+            char *id_name() { return abac_id_cn(m_id); }
+/***
+f  bool id_has_privkey()
      returns true if the ID has an associated private key
 ***/
-            bool has_privkey()
+            bool id_has_privkey()
             { return abac_id_has_privkey(m_id); }
 
 /***
-f  void write_cert(FILE *)
+f  void id_write_cert(FILE *)
      writes a PEM-encoded cert to the file handle 
-f  void write_cert(char *)
+f  void id_write_cert(char *)
      writes a PEM-encoded cert to a file named out 
 ***/
-            void write_cert(FILE *out)
+            void id_write_cert(FILE *out)
             { abac_id_write_cert(m_id, out); }
-            void write_cert(char *filename) {
+            void id_write_cert(char *filename) {
               FILE *out = fopen(filename, "a");
-              write_cert(out);
+              id_write_cert(out);
               fclose(out);
             }
 /***
-f  void write_privkey(FILE *)
+f  void id_write_privkey(FILE *)
      writes a PEM-encoded private key to the file handle
      throws an exception if no private key is loaded 
-f  void write_privkey(char *)
+f  void id_write_privkey(char *)
       writes a PEM-encoded private key a file named out
       throws an exception if no private key is loaded 
 ***/
-            void write_privkey(FILE *out) {
-              if(!has_privkey())
+            void id_write_privkey(FILE *out) {
+              if(!id_has_privkey())
                   abac_errx(1, "No privkey to write");
               abac_id_write_privkey(m_id, out);
             }
-            void write_privkey(char *filename) {
+            void id_write_privkey(char *filename) {
               FILE *out = fopen(filename, "a");
-              write_privkey(out);
+              id_write_privkey(out);
               fclose(out);
             }
 /***
-f  abac_chunk_t cert_chunk()
+f  abac_chunk_t id_cert_chunk()
      returns a DER-encoded binary representation of the X.509 ID cert
      associated with this ID.
      can be passed to libabac's Context::load_id_chunk() 
 ***/
-            abac_chunk_t cert_chunk()
+            abac_chunk_t id_cert_chunk()
             { return abac_id_cert_chunk(m_id); }
 /***
 f  char *string()
      returns literal string of the id credential
-***/
-            char *string() {
-              char *tmp=NULL;
-              if(has_privkey())
-                asprintf(&tmp,"(%s,%s,y)",abac_id_name(m_id),abac_id_idtype_string(m_id));
-                else asprintf(&tmp,"(%s,%s,n)",abac_id_name(m_id),abac_id_idtype_string(m_id));
-              return tmp;
-            }
+     (c:abac_id_string)
+***/
+            char *string()
+            { return abac_id_string(m_id); }
         public:
             abac_id_t *m_id;
@@ -759,10 +748,10 @@
             ~Attribute()
             { if(m_attr) abac_attribute_free(m_attr); }
-/***
+/*ii**
 f  Attribute(abac_attribute_t *)
      constructor that takes abac_attribute_t, locally used
 f  Attribute(abac_credential_t *)
      constructor that takes abac_credential_t, locally used 
-***/
+**ii*/
             Attribute(abac_attribute_t *attr): m_attr(abac_attribute_dup(attr)) 
             { }
@@ -777,4 +766,5 @@
        - the Head role is invalid
        - the validity period is invalid (must be >= 1 second) 
+     (c:abac_attribute_create)
 ***/
             Attribute(Role& head, int validity) {
@@ -791,4 +781,5 @@
        - the Head oset is invalid
        - the validity period is invalid (must be >= 1 second) 
+     (c:abac_attribute_create)
 ***/
             Attribute(Oset& head, int validity) {
@@ -798,15 +789,15 @@
             }
 /***
-f  bool add_tail(Role&)
+f  bool attribute_add_tail(Role&)
       Add a role tail.  Call multiple times for intersections
-f  bool add_tail(Oset&)
+f  bool attribute_add_tail(Oset&)
       Add an oset tail.  Call multiple times for intersections
 ***/
-            bool add_tail(Role& tail) {
+            bool attribute_add_tail(Role& tail) {
               if(abac_attribute_add_tail(m_attr, tail.role()))
                   return 1;
                   else return 0;
             }
-            bool add_tail(Oset& tail) {
+            bool attribute_add_tail(Oset& tail) {
               if(abac_attribute_add_tail(m_attr, tail.oset()))
                   return 1;
@@ -819,14 +810,8 @@
      returns literal string of tail of the attribute
 ***/
-            char *head_string() {
-              abac_aspect_t *head=abac_attribute_head(m_attr);
-              char *string=abac_aspect_string(head);
-              return string;
-            }
-            char *tail_string() {
-              abac_aspect_t *tail=abac_attribute_tail(m_attr);
-              char *string=abac_aspect_string(tail);
-              return string;
-            }
+            char *head_string()
+            { return abac_head_string(m_attr); }
+            char *tail_string()
+            { return abac_tail_string(m_attr); }
 /***
 f  char *head_typed_string()
@@ -835,38 +820,21 @@
      returns typed literal string of tail of the attribute
 ***/
-            char *head_typed_string() {
-              abac_aspect_t *head=abac_attribute_head(m_attr);
-              char *string=abac_aspect_typed_string(head);
-              return string;
-            }
-            char *tail_typed_string() {
-              abac_aspect_t *tail=abac_attribute_tail(m_attr);
-              char *string=abac_aspect_typed_string(tail);
-              return string;
-            }
+            char *head_typed_string()
+            { return abac_head_typed_string(m_attr); }
+            char *tail_typed_string()
+            { return abac_tail_typed_string(m_attr); }
 /***
 f  char *string()
      returns literal string of the attribute
+     (c:abac_attribute_string)
 f  char *typed_string()
      returns typed literal string of the attribute
-***/
-            char *string() {
-              char *head=head_string();
-              char *tail=tail_string();
-              if(head==NULL || tail==NULL)
-                  abac_errx(1, "attribute string, head and tail can not be NULL");
-              char *tmp=NULL;
-              asprintf(&tmp,"%s<-%s",head,tail);
-              return tmp;
-            }
-            char *typed_string() {
-              char *head=head_typed_string();
-              char *tail=tail_typed_string();
-              if(head==NULL || tail==NULL)
-                  abac_errx(1, "attribute string, head and tail can not be NULL");
-              char *tmp=NULL;
-              asprintf(&tmp,"%s<-%s",head,tail);
-              return tmp;
-            }
+     (c:abac_attribute_typed_string)
+***/
+            char *string()
+            { return abac_attribute_string(m_attr); }
+            char *typed_string()
+            { return abac_attribute_typed_string(m_attr); }
+
 /*** ??? not sure about implmentation
 f  const Role &role_head()
@@ -885,5 +853,5 @@
               return oset;
             }
-/*** ???
+/*** 
 f  std::vector<Role> role_tails(bool &)
      retrieve tail role which maybe more than 1 if intersecting
@@ -925,17 +893,17 @@
               return osets;
             }
-/***
+/*ii**
 f  abac_attribute_t *attribute()
       return libabac structure for attribute
-***/
+**ii*/
             abac_attribute_t *attribute() { return m_attr; }
 
 /***
-f  bool bake()
+f  bool attribute_bake()
      Generate the cert. Call this after you've added subjects to your cert.
      This returns false if there are no subjects
      This will throw an exception if the cert's already been baked.
 ***/
-            bool bake() {
+            bool attribute_bake() {
               /* can not bake in ABAC_CN mode */
               if(USE("ABAC_CN"))
@@ -946,28 +914,28 @@
             }
 /***
-f  bool baked()
+f  bool attribute_baked()
      returns true iff the cert has been baked.
 ***/
-            bool baked()
+            bool attribute_baked()
             { return abac_attribute_baked(m_attr); }
 
 /***
-f  void write_cert(FILE *)
+f  void attribute_write_cert(FILE *)
      write the DER-encoded X.509 attribute cert to the open file handle
      Throws an exception if the cert isn't baked 
 ***/
-            void write_cert(FILE *out) {
-              int rt= abac_attribute_write(m_attr,out);
+            void attribute_write_cert(FILE *out) {
+              int rt= abac_attribute_write_cert(m_attr,out);
               if(!rt)
                   abac_errx(1, "write, cert is not baked");
             }
 /***
-f  void write_cert(char *)
+f  void attribute_write_cert(char *)
      write the DER-encoded X.509 attribute cert to a file named out
      Throws an exception if the cert isn't baked 
 ***/
-            void write_cert(char *filename) {
+            void attribute_write_cert(char *filename) {
               FILE *out = fopen(filename, "w");
-              write_cert(out);
+              attribute_write_cert(out);
               fclose(out);
             }
@@ -981,15 +949,4 @@
             abac_chunk_t cert_chunk()
             { return abac_attribute_cert_chunk(m_attr); }
-
-/***
-f  int consume()
-     generate yap clauses and injected into db 
-***/
-            int consume() {
-              /* attribute needs to be baked */  
-              if(!baked()) {
-                  return ABAC_ATTRIBUTE_FAIL;
-              }
-            }
       private:
             abac_attribute_t *m_attr;
@@ -1021,8 +978,9 @@
             }
 /***
-f  void dump_yap()
+f  void dump_yap_db()
      dump the complete yap prolog database
-***/
-            void dump_yap()
+     (c:show_yap_db)
+***/
+            void dump_yap_db()
             { show_yap_db("dump_yap"); }
 
@@ -1030,11 +988,15 @@
 f  int load_id(ABAC::ID&)
      load id cert from ID 
+     (c:abac_context_load_id)
 f  int load_id_file(char *)
      load id cert from an idkey combo file. key retrieval will be attempt
      but won't fail if not found
-f  int load_id_file(char *, char *) 
+     (c:abac_context_load_id_file)
+f  int load_id_files(char *, char *) 
      load id cert from an id file and a key file
+     (c:abac_context_load_id_files)
 f  int load_id_chunk(abac_chunk_t) 
      load id cert from a chunk structure
+     (c:abac_context_load_id_chunk)
      returns:
        ABAC_CERT_SUCCESS   successfully loaded
@@ -1043,9 +1005,9 @@
 ***/
             int load_id(ABAC::ID& id)
-            { return abac_context_load_id_id(m_ctx, id.id()); }
+            { return abac_context_load_id(m_ctx, id.id()); }
             int load_id_file(char *filename)
-            { return abac_context_load_id_idkey_file(m_ctx, filename); }
-            int load_id_file(char *filename, char *keyfilename) 
-            { return abac_context_load_id_id_file_key_file(m_ctx, filename, keyfilename); }
+            { return abac_context_load_id_file(m_ctx, filename); }
+            int load_id_files(char *filename, char *keyfilename) 
+            { return abac_context_load_id_files(m_ctx, filename, keyfilename); }
             int load_id_chunk(abac_chunk_t cert) 
             { return abac_context_load_id_chunk(m_ctx, cert); }
@@ -1054,8 +1016,11 @@
 f  int load_attribute(ABAC::Attribute&)
      load attribute credential from attribute structure
+     (c:abac_context_load_attribute)
 f  int load_attribute_file(char *)
      load attribute credential from a file
+     (c:abac_context_load_attribute_file)
 f  int load_attribute_chunk(abac_chunk_t)
      load attribute credential from a chunk
+     (c:abac_context_load_attribute_chunk)
 f    returns the same values as above, additionally
      returns ABAC_CERT_MISSING_ISSUER if the issuer
@@ -1063,10 +1028,9 @@
 ***/
             int load_attribute(ABAC::Attribute& a)
-            { return abac_context_load_attribute_attribute(m_ctx, a.attribute()); }
+            { return abac_context_load_attribute(m_ctx, a.attribute()); }
             int load_attribute_file(char *filename)
             { return abac_context_load_attribute_file(m_ctx, filename); }
             int load_attribute_chunk(abac_chunk_t cert)
             { return abac_context_load_attribute_chunk(m_ctx, cert); }
-
 /***
 f  void load_directory(char *)
@@ -1084,6 +1048,9 @@
      the string version is for query that is composed by hand with SHA or
      in non ABAC_CN mode  
+     (c:abac_context_query)
 f  std::vector<Attribute> query(Role &, Role &, bool &)
+     (c:abac_context_query_with_structure)
    std::vector<Attribute> query(Oset &, Oset &, bool &)
+     (c:abac_context_query_with_structure)
      runs the query:
        role <-?- principal
@@ -1205,7 +1172,7 @@
 
     Constraint::Constraint(Role& role)
-    { m_constraint=abac_condition_create_from_aspect(role.role()); }
+    { m_constraint=abac_constraint_from_role(role.role()); }
     Constraint::Constraint(Oset &oset)
-    { m_constraint=abac_condition_create_from_aspect(oset.oset()); }
+    { m_constraint=abac_constraint_from_oset(oset.oset()); }
 }
 
