Index: libabac/abac.hh
===================================================================
--- libabac/abac.hh	(revision adc08151abcf3a6562b6667bb3f75009c2a1a562)
+++ libabac/abac.hh	(revision 6e8997e69048fe15cda1e797b99fe0d409efe68b)
@@ -14,15 +14,19 @@
 /*** 
 ABAC::Constraint
-   This is a constraint on a data term. It holds a ptr to
-   a abac_condition_t structure 
+   Constraint on a data term. 
+   There are 3 types: 
+     - Role constraint on a principal
+     - Oset constraint on a principal, or a data object
+     - Range/List constraint on a data object
+   It holds a ptr to a abac_condition_t structure 
 ***/
     class Constraint {
         public:
 /***
-   Constraint()
+f  Constraint()
      default constructor, do not use, for swig only 
-   Constraint(const Constraint &)
+f  Constraint(const Constraint &)
      copy constructor, used for cloning a constraint
-   ~Constraint()
+f  ~Constraint()
      default destructor
 ***/
@@ -35,14 +39,14 @@
             }
 /***
-   Constraint(Role &)
+f  Constraint(Role &)
      constructor that takes a constraining role
        [role:?R[{role-constraint}]
-   Constraint(Oset &)
+f  Constraint(Oset &)
      constructor that takes a constraining oset
        [oset:?O[{oset-constraint}]
        [urn:?F[keyid:$alpha_keyid].oset:documents([string:?P])]
-   Constraint(abac_condition_t *)
+f  Constraint(abac_condition_t *)
      constructor that takes an abac_condition_t structure
-   Constraint(char *)
+f  Constraint(char *)
      constructor that takes one of following string
      as its vartype to set up a range constraint:
@@ -65,9 +69,9 @@
             }
 /***
-   void add_constraint_integer_max(int)
+f  void add_constraint_integer_max(int)
    void add_constraint_integer_min(int)
      utility routines to setup a integer range constraint 
        [integer:?I[10 .. 20]]
-   void add_constraint_integer_target(int)
+f  void add_constraint_integer_target(int)
      utility routine to setup a integer list constraint 
        [integer:?I[10,20]]
@@ -83,9 +87,9 @@
             }
 /***
-   void add_constraint_float_max(float)
+f  void add_constraint_float_max(float)
    void add_constraint_float_min(float)
      utility routines to setup a float range constraint 
        [float:?F[1.0 .. 2.5]]
-   void add_constraint_float_target(float)
+f  void add_constraint_float_target(float)
      utility routine to setup a float list constraint 
        [float:?F[0.5, 2.5]]
@@ -101,13 +105,12 @@
             }
 /***
-   void add_constraint_time_max(char*)
+f  void add_constraint_time_max(char*)
    void add_constraint_time_min(char*)
      utility routines to setup a time range constraint, 
      takes quoted string values, beyond T is optional 
-       [time:?M["20201101T182930"]] 
-       [time:?M["20201101T"]] 
-   void add_constraint_time_target(char*)
+       [time:?F["20120228T" .. "20120228T090000"]]
+f  void add_constraint_time_target(char*)
      utility routine to setup a time list constraint 
-       [time:?F["20120228T080000" .. "20120228T090000"]]
+       [time:?M["20201101T182930","20201101T"]] 
 ***/
             void add_constraint_time_max(char* val) {
@@ -121,11 +124,11 @@
             }
 /***
-   void add_constraint_urn_target(char*)
+f  void add_constraint_urn_target(char*)
      utility routine to setup a an urn list constraint
        [urn:?U["fileA","http://fileB"]] 
-   void add_constraint_string_target(char*)
+f  void add_constraint_string_target(char*)
      utility routine to setup a a string list constraint
        [string:?S["abc",'efg',"hij"]]
-   void add_constraint_boolean_target(char*)
+f  void add_constraint_boolean_target(char*)
      utility routine to setup a a boolean list constraint
        [boolean:?B['true']]
@@ -138,7 +141,7 @@
             { abac_condition_add_range_boolean_item(m_constraint,val); }
 /***
-   char *string() const
+f  char *string() const
      returns literal string of the constraint
-   char *typed_string() const
+f  char *typed_string() const
      returns typed literal string of the constraint
 ***/
@@ -148,5 +151,5 @@
             { return abac_condition_typed_string(m_constraint); }
 /***
-   abac_condition_t *constraint()
+f  abac_condition_t *constraint()
      returns internal constraint structure
 ***/
@@ -169,9 +172,9 @@
         public:
 /***
-   DataTerm()
+f  DataTerm()
      default constructor, do not use, for swig only 
-   DataTerm(const DataTerm &)
+f  DataTerm(const DataTerm &)
      copy constructor, used for cloning a data term
-   ~DataTerm()
+f  ~DataTerm()
      default destructor
 ***/
@@ -188,5 +191,5 @@
             }
 /*** ???
-   DataTerm(abac_term_t *)
+f  DataTerm(abac_term_t *)
      constructor to make data term from abac_term_t structure
 ***/
@@ -198,7 +201,7 @@
             }
 /***
-   DataTerm(char*)
+f  DataTerm(char*)
      constructor to make named principal data term for the oset RHS 
-   DataTerm(char*, char*, Constraint*)
+f  DataTerm(char*, char*, Constraint*)
      constructor for making a variable data term or an instantiated
      data term
@@ -224,7 +227,7 @@
             }
 /***
-   char *string() const
+f  char *string() const
      returns literal string of the data term
-   char *typed_string() const
+f  char *typed_string() const
      returns typed literal string of the data term
 ***/
@@ -234,5 +237,5 @@
             { return abac_term_typed_string(m_term); }
 /***
-   bool is_time() const
+f  bool is_time() const
    bool is_string() const
    bool is_urn() const
@@ -249,5 +252,5 @@
             { return abac_term_is_integer_type(m_term); }
 /***
-   int add_constraint(const Contraint&)
+f  int add_constraint(const Contraint&)
      utiltiy routine to add a constraint to this data term
 ***/
@@ -257,7 +260,7 @@
             }
 /***
-   int type() const
+f  int type() const
      returns subtype of the data term
-   char *name() const
+f  char *name() const
      returns the name of the data term 
 ***/
@@ -267,12 +270,12 @@
             { return abac_term_name(m_term); }
 /*** ??? value 
-   char *value() const
+f  char *value() const
      Not implemented
 ***/
             char *value() const { }
 /***
-   abac_term_t *term()
+f  abac_term_t *term()
      returns internal data term structure
-   Constraint *constraint()
+f  Constraint *constraint()
      returns internal constraint structure to the data term
 ***/
@@ -289,14 +292,14 @@
 /***
 ABAC::Role
-   A Role is role specification of a set of entitities for a principal.
+   A Role is role specification of a set of entitities for a principal
 ***/
     class Role {
         public:
 /***
-   Role()
+f  Role()
      default constructor, do not use, for swig only 
-   Role(const Role &)
+f  Role(const Role &)
      copy constructor, used for cloning a role
-   ~Role()
+f  ~Role()
      default destructor
 ***/
@@ -309,9 +312,9 @@
             }
 /***
-   Role(abac_aspect_t*)
+f  Role(abac_aspect_t*)
      constructor that takes an abac_aspect_t structure
-   Role(char*) 
+f  Role(char*) 
      constructor that builds a bare bone role with just principal's name
-   Role(char*, char*) 
+f  Role(char*, char*) 
      constructor that builds a bare bone role with just principal's name
      and a role name
@@ -326,5 +329,5 @@
             { }
 /***
-   bool is_principal() const
+f  bool is_principal() const
      return true if the role is a principal object(made from
      a data term), the right hand side of, 
@@ -334,5 +337,5 @@
             { return abac_aspect_is_principal(m_role); }
 /***
-   bool is_linking() const
+f  bool is_linking() const
      returns true if the role is a linking role like
      the right hand side of,
@@ -342,7 +345,7 @@
             { return abac_aspect_is_linking(m_role); }
 /***
-   char *string() const
+f  char *string() const
      returns literal string of the role
-   char *typed_string() const
+f  char *typed_string() const
      returns typed literal string of the role
 ***/
@@ -352,15 +355,15 @@
             { return abac_aspect_typed_string(m_role); }
 /***
-   char *linked_role() const 
+f  char *linked_role() const 
      returns linked part of a linking role, for
-     [keyid:A].role:r1.role:r2, it returns r1
+       [keyid:A].role:r1.role:r2, it returns r1
 ***/
             char *linked_role() const 
             { return abac_aspect_linked_role_name(m_role); }
 /***
-   char *role_name() const 
+f  char *role_name() const 
      returns the role name of any role (the part after the last dot)
-     [keyid:A].role.r1.role:r2, it returns r2
-     [keyid:A].role.r1, it returns r1
+       [keyid:A].role.r1.role:r2, it returns r2
+       [keyid:A].role.r1, it returns r1
 ***/
             char *role_name() const
@@ -370,5 +373,5 @@
 
 /***
-   int add_data_term(DataTerm&)
+f  int add_data_term(DataTerm&)
      add a data term to the role
 ***/
@@ -378,5 +381,5 @@
             }
 /***
-   std::vector<DataTerm> get_data_terms(bool &)
+f  std::vector<DataTerm> get_data_terms(bool &)
      return the data terms bound to this role.
      ??? If the role is returned in a proof, these will all have values.
@@ -399,5 +402,5 @@
             }
 /***
-   std::vector<DataTerm> get_linked_data_terms(bool &)
+f  std::vector<DataTerm> get_linked_data_terms(bool &)
      return the data terms bound to this role's linking role.
      ??? If the role is returned in a proof, these will all have values.
@@ -416,5 +419,5 @@
             }
 /***
-   abac_aspect_t *role()
+f  abac_aspect_t *role()
      returns the interal libabac representation of this role
 ***/
@@ -426,14 +429,14 @@
 /***
 ABAC::Oset
-   An Oset is oset specification of a set of entitities for a principal.
+   An Oset is oset specification of a set of entitities for a principal
 ***/
     class Oset {
         public:
 /***
-   Oset()
+f  Oset()
      default constructor, do not use, for swig only
-   Oset(const Oset &)
+f  Oset(const Oset &)
      copy constructor, used for cloning an oset
-   ~Oset()
+f  ~Oset()
      default destructor
 ***/
@@ -444,11 +447,11 @@
             { if(m_oset) abac_aspect_free(m_oset); }
 /***
-   Oset(abac_aspect_t *)
+f  Oset(abac_aspect_t *)
      constructor that takes abac_aspect_t structure
-   Oset(char *)
+f  Oset(char *)
      constructor that makes a principal oset, ie [keyid:B]
-   Oset(char *, char *)
+f  Oset(char *, char *)
      constructor that makes a regular oset, ie. [keyid:B].oset:o
-   Oset(DataTerm&)
+f  Oset(DataTerm&)
      constructor that makes an object oset, ie. [urn:'file/fileA']
 ***/
@@ -465,5 +468,5 @@
 
 /***
-   bool is_object(), ie <- [integer:10]
+f  bool is_object(), ie <- [integer:10]
      return ture if this oset is an object oset
 ***/
@@ -471,5 +474,5 @@
             { return abac_aspect_is_object(m_oset); }
 /***
-   bool is_principal() const
+f  bool is_principal() const
      return true if the oset is a principal object(made from
      a data term), the right hand side of, 
@@ -479,5 +482,5 @@
             { return abac_aspect_is_principal(m_oset); }
 /***
-   bool is_linking() const
+f  bool is_linking() const
      returns true if the oset is a linking oset like
      the right hand side of,
@@ -487,7 +490,7 @@
             { return abac_aspect_is_linking(m_oset); }
 /***
-   char *string() const
+f  char *string() const
      returns literal string of the oset
-   char *typed_string() const
+f  char *typed_string() const
      returns typed literal string of the oset
 ***/
@@ -497,34 +500,34 @@
             { return abac_aspect_typed_string(m_oset); }
 /***
-   char *linked_role() const 
+f  char *linked_role() const 
      returns linked part of a linking oset, for
-     [keyid:A].role:r1.oset:o1, it returns r1
+       [keyid:A].role:r1.oset:o1, it returns r1
 ***/
             char *linked_role() const 
             { return abac_aspect_linked_role_name(m_oset); }
 /***
-   char *oset_name() const 
+f  char *oset_name() const 
      returns oset name,
-     [keyid:A].role:r1.oset:o1, it returns o1
-     [keyid:A].oset:o1, it returns o1
+       [keyid:A].role:r1.oset:o1, it returns o1
+       [keyid:A].oset:o1, it returns o1
 ***/
             char *oset_name() const
             { return abac_aspect_aspect_name(m_oset); }
 /***
-   char *principal() const 
+f  char *principal() const 
      returns principal name,
-     [keyid:A].role:r1.oset:o1, it returns A 
+       [keyid:A].role:r1.oset:o1, it returns A 
 ***/
             char *principal() const
             { return abac_aspect_principal_name(m_oset); }
 /***
-   char *object() const 
+f  char *object() const 
      returns object's name when the oset is a principal object
-     [keyid:A].oset:values <- [integer:10], it returns 10
+       [keyid:A].oset:values <- [integer:10], it returns 10
 ***/
             char *object() const 
             { return abac_aspect_object_name(m_oset); }
 /***
-   int add_data_term(DataTerm&)
+f  int add_data_term(DataTerm&)
      add a data term to this oset's parameter set
      always returns 1
@@ -535,5 +538,5 @@
             }
 /***
-   std::vector<DataTerm> get_data_terms(bool &)
+f  std::vector<DataTerm> get_data_terms(bool &)
      returns the data terms bound to this oset.  
      ??? If the oset is returned in a proof, these will all have values.
@@ -552,5 +555,5 @@
             }
 /***
-   int add_linking_data_term(DataTerm&)
+f  int add_linking_data_term(DataTerm&)
      add a data term to this oset's linking role's parameter set.
      always returns 1
@@ -561,5 +564,5 @@
             }
 /***
-   std::vector<DataTerm> get_linked_data_terms(bool &)
+f  std::vector<DataTerm> get_linked_data_terms(bool &)
      returns the data terms bound to this oset's linking role.  
      ??? If the oset is returned in a proof, these will all have values.
@@ -578,5 +581,5 @@
             }
 /***
-   abac_aspect_t *oset()
+f  abac_aspect_t *oset()
      returns the internal libabac representation of the oset
 ***/
@@ -596,9 +599,9 @@
         public:
 /***
-   ID()
+f  ID()
      default constructor, do not use, for swig only
-   ID(const ID &)
+f  ID(const ID &)
      copy constructor, used for cloning an ID
-   ~ID()
+f  ~ID()
      default destructor
 ***/
@@ -607,7 +610,7 @@
             ~ID() { if(m_id) abac_id_free(m_id); }
 /*** ???
-   ID(abac_id_t *)
+f  ID(abac_id_t *)
      constructor from abac_id_t
-   ID(abac_id_credential_t *)
+f  ID(abac_id_credential_t *)
      constructor from abac_id_t
 ***/
@@ -621,5 +624,5 @@
 
 /*** 
-   ID(char *)
+f  ID(char *)
      load an ID cert from a file, will throw an exception 
      if the cert cannot be loaded 
@@ -631,5 +634,5 @@
             }
 /*** 
-   ID(char *,int)
+f  ID(char *,int)
      generates a new ID with the supplied CN and validity period
      - CN must be alphanumeric and begin with a letter
@@ -643,5 +646,5 @@
             }
 /*** 
-   void load_privkey(char *)
+f  void load_privkey(char *)
      loads the private key associated with the ID credential
      will throw an exception if the key cannot be loaded 
@@ -653,5 +656,5 @@
             }
 /***
-   abac_id_t *id()
+f  abac_id_t *id()
      returns the abac_id_t 
      returns the interal libabac representation of this id
@@ -660,7 +663,7 @@
 
 /***
-   char *keyid()
+f  char *keyid()
      returns the SHA1 keyid of the id cert
-   char *name()
+f  char *name()
      returns the CN (the parameter passed to the constructor or the
      CN of the cert).
@@ -669,5 +672,5 @@
             char *name() { return abac_id_cn(m_id); }
 /***
-   bool has_privkey()
+f  bool has_privkey()
      returns true if the ID has an associated private key
 ***/
@@ -676,7 +679,7 @@
 
 /***
-   void write_cert(FILE *)
+f  void write_cert(FILE *)
      writes a PEM-encoded cert to the file handle 
-   void write_cert(char *)
+f  void write_cert(char *)
      writes a PEM-encoded cert to a file named out 
 ***/
@@ -689,8 +692,8 @@
             }
 /***
-   void write_privkey(FILE *)
+f  void write_privkey(FILE *)
      writes a PEM-encoded private key to the file handle
      throws an exception if no private key is loaded 
-   void write_privkey(char *)
+f  void write_privkey(char *)
       writes a PEM-encoded private key a file named out
       throws an exception if no private key is loaded 
@@ -707,5 +710,5 @@
             }
 /***
-   abac_chunk_t cert_chunk()
+f  abac_chunk_t cert_chunk()
      returns a DER-encoded binary representation of the X.509 ID cert
      associated with this ID.
@@ -715,5 +718,5 @@
             { return abac_id_cert_chunk(m_id); }
 /***
-   char *string()
+f  char *string()
      returns literal string of the id credential
 ***/
@@ -733,9 +736,9 @@
 ABAC::Attribute
    This is the attribute representation for the access policy rule
-          LHS <- RHS
+       LHS <- RHS
    The sequence of generation is to 
-     first, instantiate the object, ie, LHS (head)
-     second, adding subject(s) to it, ie, RHS (tail)
-     and then baking it.
+       first, instantiate the object, ie, LHS (head)
+       second, adding subject(s) to it, ie, RHS (tail)
+       and then baking it.
    Only once it's baked can you access the X.509 cert. 
    Once it's been baked you can no longer add subjects to it
@@ -744,9 +747,9 @@
         public:
 /***
-   Attribute()
+f  Attribute()
      default constructor, do not use, for swig only 
-   Attribute(const Attribute &)
+f  Attribute(const Attribute &)
      copy constructor, used for cloning an attribute
-   ~Attribute()
+f  ~Attribute()
      default destructor
 ***/
@@ -757,7 +760,7 @@
             { if(m_attr) abac_attribute_free(m_attr); }
 /***
-   Attribute(abac_attribute_t *)
+f  Attribute(abac_attribute_t *)
      constructor that takes abac_attribute_t, locally used
-   Attribute(abac_credential_t *)
+f  Attribute(abac_credential_t *)
      constructor that takes abac_credential_t, locally used 
 ***/
@@ -767,5 +770,5 @@
             { m_attr=abac_attribute_dup(abac_credential_attribute(cred)); }
 /***
-   Attribute(Role&, int)
+f  Attribute(Role&, int)
      constructor that creates an attribute policy to be signed by the issuer 
      with the given role with a specified validity period 
@@ -781,5 +784,5 @@
             }
 /***
-   Attribute(Oset&, int)
+f  Attribute(Oset&, int)
      constructor that creates an attribute policy to be signed by the issuer 
      with the given oset with a specified validity period 
@@ -795,7 +798,7 @@
             }
 /***
-   bool add_tail(Role&)
+f  bool add_tail(Role&)
       Add a role tail.  Call multiple times for intersections
-   bool add_tail(Oset&)
+f  bool add_tail(Oset&)
       Add an oset tail.  Call multiple times for intersections
 ***/
@@ -811,7 +814,7 @@
             }
 /***
-   char *head_string()
+f  char *head_string()
      returns literal string of head of the attribute
-   char *tail_string()
+f  char *tail_string()
      returns literal string of tail of the attribute
 ***/
@@ -827,7 +830,7 @@
             }
 /***
-   char *head_typed_string()
+f  char *head_typed_string()
      returns typed literal string of head of the attribute
-   char *tail_typed_string()
+f  char *tail_typed_string()
      returns typed literal string of tail of the attribute
 ***/
@@ -843,7 +846,7 @@
             }
 /***
-   char *string()
+f  char *string()
      returns literal string of the attribute
-   char *typed_string()
+f  char *typed_string()
      returns typed literal string of the attribute
 ***/
@@ -867,7 +870,7 @@
             }
 /*** ??? not sure about implmentation
-   const Role &role_head()
+f  const Role &role_head()
      returns the head role
-   const Oset &oset_head()
+f  const Oset &oset_head()
      returns the oset head
 ***/
@@ -883,7 +886,7 @@
             }
 /*** ???
-   std::vector<Role> role_tails(bool &)
+f  std::vector<Role> role_tails(bool &)
      retrieve tail role which maybe more than 1 if intersecting
-   std::vector<Oset> oset_tails(bool &)
+f  std::vector<Oset> oset_tails(bool &)
      retrieve tail oset which maybe more than 1 if intersecting
 ***/
@@ -923,5 +926,5 @@
             }
 /***
-   abac_attribute_t *attribute()
+f  abac_attribute_t *attribute()
       return libabac structure for attribute
 ***/
@@ -929,5 +932,5 @@
 
 /***
-   bool bake()
+f  bool bake()
      Generate the cert. Call this after you've added subjects to your cert.
      This returns false if there are no subjects
@@ -943,5 +946,5 @@
             }
 /***
-   bool baked()
+f  bool baked()
      returns true iff the cert has been baked.
 ***/
@@ -950,5 +953,5 @@
 
 /***
-   void write_cert(FILE *)
+f  void write_cert(FILE *)
      write the DER-encoded X.509 attribute cert to the open file handle
      Throws an exception if the cert isn't baked 
@@ -960,5 +963,5 @@
             }
 /***
-   void write_cert(char *)
+f  void write_cert(char *)
      write the DER-encoded X.509 attribute cert to a file named out
      Throws an exception if the cert isn't baked 
@@ -970,5 +973,5 @@
             }
 /***
-   abac_chunk_t cert_chunk()
+f  abac_chunk_t cert_chunk()
      returns a DER-encoded binary representation of the X.509 attribute
      cert associated with this cert
@@ -980,5 +983,5 @@
 
 /***
-   int consume()
+f  int consume()
      generate yap clauses and injected into db 
 ***/
@@ -996,14 +999,14 @@
 /*** 
 ABAC::Context
-   An ABAC Context 
+    An ABAC Context 
 ***/
     class Context {
         public:
 /***
-   Context()
+f  Context()
      default constructor
-   Context(const Context &)
+f  Context(const Context &)
      copy constructor, used for cloning the context
-   ~Context()
+f  ~Context()
      default destructor
 ***/
@@ -1018,5 +1021,5 @@
             }
 /***
-   void dump_yap()
+f  void dump_yap()
      dump the complete yap prolog database
 ***/
@@ -1025,14 +1028,14 @@
 
 /***
-   int load_id(ABAC::ID&)
+f  int load_id(ABAC::ID&)
      load id cert from ID 
-   int load_id_file(char *)
+f  int load_id_file(char *)
      load id cert from an idkey combo file. key retrieval will be attempt
      but won't fail if not found
-   int load_id_file(char *, char *) 
+f  int load_id_file(char *, char *) 
      load id cert from an id file and a key file
-   int load_id_chunk(abac_chunk_t) 
+f  int load_id_chunk(abac_chunk_t) 
      load id cert from a chunk structure
-   returns:
+     returns:
        ABAC_CERT_SUCCESS   successfully loaded
        ABAC_CERT_INVALID   invalid certificate (or file not found)
@@ -1049,13 +1052,13 @@
 
 /***
-   int load_attribute(ABAC::Attribute&)
+f  int load_attribute(ABAC::Attribute&)
      load attribute credential from attribute structure
-   int load_attribute_file(char *)
+f  int load_attribute_file(char *)
      load attribute credential from a file
-   int load_attribute_chunk(abac_chunk_t)
+f  int load_attribute_chunk(abac_chunk_t)
      load attribute credential from a chunk
-   returns the same values as above, additionally
-   returns ABAC_CERT_MISSING_ISSUER if the issuer
-   certificate has not been loaded 
+f    returns the same values as above, additionally
+     returns ABAC_CERT_MISSING_ISSUER if the issuer
+     certificate has not been loaded 
 ***/
             int load_attribute(ABAC::Attribute& a)
@@ -1067,7 +1070,7 @@
 
 /***
-   void load_directory(char *)
+f  void load_directory(char *)
      load a directory full of certificates:
-        first: ${path}/*_ID.{der,pem} as identity certificates
+f       first: ${path}/*_ID.{der,pem} as identity certificates
                implicitly looking for ${path}/*_private.{der,pem} as
                the private key file
@@ -1078,14 +1081,15 @@
             { abac_context_load_directory(m_ctx, path); }
 /*** 
-   std::vector<Attribute> query(char *, char *, bool &)
+f  std::vector<Attribute> query(char *, char *, bool &)
      the string version is for query that is composed by hand with SHA or
      in non ABAC_CN mode  
-   std::vector<Attribute> query(Role &, Role &, bool &)
+f  std::vector<Attribute> query(Role &, Role &, bool &)
    std::vector<Attribute> query(Oset &, Oset &, bool &)
-
      runs the query:
        role <-?- principal
+       oset <-?- principal/obj
      returns true/false in success
-     returns a proof upon success, partial proof on failure 
+     returns a proof upon success, 
+     partial proof on failure (not implemented yet) 
 ***/
             std::vector<Attribute> query(char *role, char *principal, bool &success) {
@@ -1146,5 +1150,5 @@
 
 /***
-   std::vector<Attribute> context_credentials(bool &)
+f  std::vector<Attribute> context_credentials(bool &)
      returns a vector of all the credentials loaded in the context
      extracted from the internal data structure
@@ -1169,5 +1173,5 @@
 
 /***
-   std::vector<Attribute> context_principals(bool &)
+f  std::vector<Attribute> context_principals(bool &)
      returns a vector of all the principals loaded in the context
      extracted from the internal data structure
@@ -1190,5 +1194,5 @@
             }
 /***
-   char *version()
+f  char *version()
      return the version of this interface
 ***/
