Index: examples/creddy_prover_tests/allout.save
===================================================================
--- examples/creddy_prover_tests/allout.save	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
+++ examples/creddy_prover_tests/allout.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -161,5 +161,5 @@
 prover success!!
 credentials needed :
- pStateU.foundingAlumni  <- pStateU.diploma(_,Year:[1955..1958]) 
+ pStateU.foundingAlumni  <- pStateU.diploma(_,Year:[1955 .. 1958]) 
  pStateU.diploma('psychology',1956)  <- pMaryann 
  
@@ -168,5 +168,5 @@
 prover success!!
 credentials needed :
- pStateU.foundingAlumni  <- pStateU.diploma(_,Year:[1955..1958]) 
+ pStateU.foundingAlumni  <- pStateU.diploma(_,Year:[1955 .. 1958]) 
  pStateU.diploma('zoology',1955)  <- pJoe 
 
@@ -189,5 +189,5 @@
 prover success!!
 credentials needed :
- pLeague.stadium('access',B:[true],F:[20120228T080000..20120228T090000])  <- pLeague.players(T) 
+ pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000])  <- pLeague.players(T) 
  pLeague.players('south')  <- pMark 
 
@@ -257,5 +257,5 @@
 prover success!!
 credentials needed :
- pMary.what2eat  <- pRalphs.fruitprice(P:[..2.00]) 
+ pMary.what2eat  <- pRalphs.fruitprice(P:[.. 2.00]) 
  pRalphs.fruitprice(0.50)  <- 'navel orange' 
  
@@ -264,5 +264,5 @@
 prover success!!
 credentials needed :
- pMary.what2eat  <- pRalphs.fruitprice(P:[..2.00]) 
+ pMary.what2eat  <- pRalphs.fruitprice(P:[.. 2.00]) 
  pRalphs.fruitprice(1.50)  <- 'kiwi' 
  
Index: examples/creddy_prover_tests/balltime_rt2/README
===================================================================
--- examples/creddy_prover_tests/balltime_rt2/README	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
+++ examples/creddy_prover_tests/balltime_rt2/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -64,6 +64,6 @@
 
 
-# [keyid:league].oset:gametime([time:20120228T130000])
-#                    <- [keyid:league].oset:players([string:'north') 
+# [keyid:league].oset:gametime(string:'north')
+#                                <- [time:20120228T130000]
 # Credential 3
 creddy --attribute \
@@ -73,6 +73,6 @@
         --out League_gametime_north__timeT_attr.der
 
-# [keyid:league].oset:gametime([time:20120228T140000])
-#                    <- [keyid:league].oset:players([string:'south') 
+# [keyid:league].oset:gametime(string:'south')
+#                                <- [time:20120228T140000]
 # Credential 4 
 creddy --attribute \
Index: examples/python_tests/access_rt2/access.save
===================================================================
--- examples/python_tests/access_rt2/access.save	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
+++ examples/python_tests/access_rt2/access.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -13,5 +13,6 @@
 YAP query succeed
 pAlpha.team('proj2') <- pJoe
-...initial principal set...
+
+...final principal set...
 (pAlpha,keyid,y) 
 (pBob,keyid,y) 
@@ -19,5 +20,6 @@
 
 
-...initial policy attribute set...
+
+...final policy attribute set...
 pAlpha.access('Read','file//fileB') <- pBob
 pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
Index: examples/python_tests/access_rt2/attr.py
===================================================================
--- examples/python_tests/access_rt2/attr.py	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
+++ examples/python_tests/access_rt2/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -5,7 +5,4 @@
 
 cmd1:env keystore=`pwd` ./attr.py 
-expect this to fail,
-cmd2: env ABAC_CN=1 keystore=`pwd` ./attr.py
-
 """
 
Index: examples/python_tests/access_rt2/query.py
===================================================================
--- examples/python_tests/access_rt2/query.py	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
+++ examples/python_tests/access_rt2/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -82,18 +82,13 @@
 
 ##########################################################################
-# dump the yap dB
-#
-#ctxt.dump_yap_db()
-
-##########################################################################
 # dump the loaded principals/policies 
 #
 out = ctxt.context_principals()
-print "...initial principal set..."
+print "\n...final principal set..."
 for x in out[1]:
     print "%s " % x.string()
 print "\n"
 out = ctxt.context_credentials()
-print "...initial policy attribute set..."
+print "\n...final policy attribute set..."
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
Index: examples/python_tests/access_rt2/run_test
===================================================================
--- examples/python_tests/access_rt2/run_test	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
+++ examples/python_tests/access_rt2/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -4,10 +4,10 @@
 export ABAC_PROVER_PATH
 
+
+rm -rf *der *pem
+
 echo '---setup principals'
-# Two pre-existing id credentials are generated using separate python
-# script (just to show we can)
 env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
 
-# Add policy attribute credentials along with a new id credential
 echo '---setup attributes'
 env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
Index: examples/python_tests/acme_friend_rt1/README
===================================================================
--- examples/python_tests/acme_friend_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_friend_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,41 @@
+#
+# This example shows how a parameterized role can be used to infer a role and
+# that the same role can also be directly assigned.  The example has 4
+# principals, the Acme company, a Coyote, a RoadRUnner and a Jackrabbit.
+#
+# The policy of the Acme company is that anyone the Acme company thinks is a
+# friend of the Roadrunner is a preferred customer.  A friend of the roadrunner
+# has the [keyid:Acme}.role:friendOf([keyid:Roadrunner]) role, and a preferred
+# customer has the [keyid:Acme].role:preferred_customer role.
+#
+# This script creates the 4 and 3 credentials.  Credential 1 lays out the rule
+# that friends of the Roadrunner are preferred customers.  Credential 2
+# directly makes the Coyote a preferred customer.  Credential 3 recognizes that
+# Acme thinks that the Jackrabbit is the Roadrunner's friend.
+# 
+# The attached ./run_query script tests whether the coyote is a friend of the
+# Roadrunner (which fails), whether the Jackrabbit is a friend of teh
+# Roadrunner (which succeeds), whether the Jackrabbit is a preferred customer
+# (which succeeds), whether the Coyote is a prefered customer (succeeds for a
+# different reason) and whether the system fails to load a bad certificate (it
+# does).
+
+# acme_friend_rt1
+
+#[keyid:Acme].role:friendof([keyid:Roadrunner]) <-?- [keyid:Coyote] (no)
+#[keyid:Acme].role:preferred_customer <-?- [keyid:Jackrabbit] (yes)
+
+creddy --generate --cn Acme
+creddy --generate --cn Coyote
+creddy --generate --cn Roadrunner
+creddy --generate --cn Jackrabbit
+
+roadrunner_keyid=`creddy --keyid --cert Roadrunner_ID.pem`
+friendof_roadrunner="friendOf([keyid:$roadrunner_keyid])"
+
+#[keyid:Acme].role:preferred_customer <- [keyid:Acme].role:friendOf([keyid:Roadrunner])
+
+#[keyid:Acme].role:prefered_customer <- [keyid:Coyote]
+
+#[keyid:Acme].role:friendOf([keyid:Roadrunner]) <- [keyid:Jackrabbit]
+
Index: examples/python_tests/acme_friend_rt1/attr.py
===================================================================
--- examples/python_tests/acme_friend_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_friend_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,92 @@
+#!/usr/bin/env python
+
+"""
+  Setup access policy attribute rules
+
+cmd1:env keystore=`pwd` ./attr.py 
+
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+acmeID=ABAC.ID("Acme_ID.pem")
+acmeID.id_load_privkey_file("Acme_private.pem");
+acme=acmeID.id_keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem")
+coyoteID.id_load_privkey_file("Coyote_private.pem");
+coyote=coyoteID.id_keyid()
+
+roadrunnerID=ABAC.ID("Roadrunner_ID.pem")
+roadrunnerID.id_load_privkey_file("Roadrunner_private.pem");
+roadrunner=roadrunnerID.id_keyid()
+
+jackrabbitID=ABAC.ID("Jackrabbit_ID.pem")
+jackrabbitID.id_load_privkey_file("Jackrabbit_private.pem");
+jackrabbit=jackrabbitID.id_keyid()
+
+################################################
+# [keyid:Acme].role:preferred_customer <- [keyid:Acme].role:friendof([keyid:Roadrunner])
+head = ABAC.Role(acme,"preferred_customer")
+param=ABAC.DataTerm(roadrunnerID)
+tail = ABAC.Role(acme,"friendof")
+tail.role_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Acme_preferred_customer__Acme_friendof_Roadrunner_attr.der")
+ctxt.load_attribute_file("Acme_preferred_customer__Acme_friendof_Roadrunner_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Acme].role:prefered_customer <- [keyid:Coyote]
+head = ABAC.Role(acme,"preferred_customer")
+tail = ABAC.Role(coyote)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Acme_preferred_customer__Coyote_attr.der")
+ctxt.load_attribute_file("Acme_preferred_customer__Coyote_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Acme].role:friendof([keyid:Roadrunner]) <- [keyid:Jackrabbit]
+param=ABAC.DataTerm(roadrunnerID)
+head = ABAC.Role(acme,"friendof")
+head.role_add_data_term(param)
+tail = ABAC.Role(jackrabbit)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Acme_friendof_Roadrunner__Jackrabbit_attr.der")
+ctxt.load_attribute_file("Acme_friendof_Roadrunner__Jackrabbit_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/acme_friend_rt1/friend.save
===================================================================
--- examples/python_tests/acme_friend_rt1/friend.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_friend_rt1/friend.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,32 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===bad============ Acme.friendOf(Roadrunner) <- Coyote
+YAP query failed
+
+===good============ Acme.friendOf(Roadrunner) <- Jackrabbit
+YAP query succeed
+pAcme.friendof(pRoadrunner) <- pJackrabbit
+
+===good============ Acme.preferred_customer <- Jackrabbit
+YAP query succeed
+pAcme.preferred_customer <- pAcme.friendof(pRoadrunner)
+pAcme.friendof(pRoadrunner) <- pJackrabbit
+
+===good============ Acme.preferred_customer <- Coyote
+YAP query succeed
+pAcme.preferred_customer <- pCoyote
+
+...final principal set...
+(pAcme,keyid,y) 
+(pCoyote,keyid,y) 
+(pJackrabbit,keyid,y) 
+(pRoadrunner,keyid,y) 
+
+
+
+...final policy attribute set...
+pAcme.friendof(pRoadrunner) <- pJackrabbit
+pAcme.preferred_customer <- pAcme.friendof(pRoadrunner)
+pAcme.preferred_customer <- pCoyote
+
+
Index: examples/python_tests/acme_friend_rt1/query.py
===================================================================
--- examples/python_tests/acme_friend_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_friend_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,101 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+acmeID=ABAC.ID("Acme_ID.pem")
+acmeID.id_load_privkey_file("Acme_private.pem");
+acme=acmeID.id_keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem")
+coyoteID.id_load_privkey_file("Coyote_private.pem");
+coyote=coyoteID.id_keyid()
+
+roadrunnerID=ABAC.ID("Roadrunner_ID.pem")
+roadrunnerID.id_load_privkey_file("Roadrunner_private.pem");
+roadrunner=roadrunnerID.id_keyid()
+
+jackrabbitID=ABAC.ID("Jackrabbit_ID.pem")
+jackrabbitID.id_load_privkey_file("Jackrabbit_private.pem");
+jackrabbit=jackrabbitID.id_keyid()
+
+##########################################################################
+# role =[keyid:Acme].role:friendof([keyid:Roadrunner]) 
+# p= [keyid:Coyote]
+param=ABAC.DataTerm(roadrunnerID)
+role = ABAC.Role(acme,"friendof")
+role.role_add_data_term(param)
+p = ABAC.Role(coyote)
+print "\n===bad============ Acme.friendOf(Roadrunner) <- Coyote"
+out = ctxt.query(role, p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role =[keyid:Acme].role:friendof([keyid:Roadrunner]) 
+# p= [keyid:Jackrabbit]
+param=ABAC.DataTerm(roadrunnerID)
+role = ABAC.Role(acme,"friendof")
+role.role_add_data_term(param)
+p = ABAC.Role(jackrabbit)
+print "\n===good============ Acme.friendOf(Roadrunner) <- Jackrabbit"
+out = ctxt.query(role, p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# role =[keyid:Acme].role:preferred_customer
+# p =[keyid:Jackrabbit]
+role = ABAC.Role(acme,"preferred_customer")
+p = ABAC.Role(jackrabbit)
+print "\n===good============ Acme.preferred_customer <- Jackrabbit"
+out = ctxt.query(role, p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role =[keyid:Acme].role:preferred_customer
+# p =[keyid:Coyote]
+role = ABAC.Role(acme,"preferred_customer")
+p = ABAC.Role(coyote)
+print "\n===good============ Acme.preferred_customer <- Coyote"
+out = ctxt.query(role, p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
Index: examples/python_tests/acme_friend_rt1/run_test
===================================================================
--- examples/python_tests/acme_friend_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_friend_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,35 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > friend.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>friend.cn 2>&1
+
+result=`diff friend.cn friend.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:acme_friend_rt1 test result differs!!!"
+    fi
+else
+    echo "   ERROR:acme_friend_rt1 test result differs!!!"
+fi
+
+
Index: examples/python_tests/acme_friend_rt1/setup.py
===================================================================
--- examples/python_tests/acme_friend_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_friend_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,30 @@
+#!/usr/bin/env python
+
+"""
+  Setup 4 principal ID credentials
+
+  Acme, Coyote, Roadrunner and Jackrabbit
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+acme=ABAC.ID("Acme", 0)
+acme.id_write_cert("Acme_ID.pem")
+acme.id_write_privkey("Acme_private.pem")
+
+coyote=ABAC.ID("Coyote", 0)
+coyote.id_write_cert("Coyote_ID.pem")
+coyote.id_write_privkey("Coyote_private.pem")
+
+roadrunner=ABAC.ID("Roadrunner", 0)
+roadrunner.id_write_cert("Roadrunner_ID.pem")
+roadrunner.id_write_privkey("Roadrunner_private.pem")
+
+jackrabbit=ABAC.ID("Jackrabbit", 0)
+jackrabbit.id_write_cert("Jackrabbit_ID.pem")
+jackrabbit.id_write_privkey("Jackrabbit_private.pem")
+
+
Index: examples/python_tests/acme_rockets_intersection_rt0/README
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_rockets_intersection_rt0/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,30 @@
+#
+# This example demonstrates intersections.  An intersection is a logical and of
+# roles or osets.  An intersection succeeds if the principal is in the
+# intersection of the sets defined by the roles.
+#
+# The policy set by Acme is that a character must both a preferred customer and
+# a WarnerBrothers character to buy rockets.  Each of those attributes is
+# specified by a role.
+#
+# This example defines 4 principals, Acme, WarnerBrothers, Coyote and Batman.
+# Credential 1 defines the policy requiring both roles to get the buy_rockets
+# role.  Credential 2 gives the Coyote a preferred_customer role.  Credential 3
+# gives Batman the preferred_customer role and Credential 4 recognizes the
+# Coyote as a Warner Brothers character.
+#
+#In order to buy rockets from Acme, you must be BOTH a preferred customer
+#AND a WarnerBros character. In this example, the following query will be
+#successful:
+#
+#    Acme.buy_rockets <-?- Coyote
+#
+#The following query will fail (because Batman does not have the
+#attribute WarnerBros.character):
+#
+#    Acme.buy_rockets <-?- Batman
+# 
+# Acme.buy_rockets <- Acme.preferred_customer & WarnerBros.character
+# Acme.preferred_customer <- Coyote
+# Acme.preferred_customer <- Batman
+# WarnerBros.character <- Coyote
Index: examples/python_tests/acme_rockets_intersection_rt0/attr.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,96 @@
+#!/usr/bin/env python
+
+"""
+  Setup access policy attribute rules
+
+cmd1:env keystore=`pwd` ./attr.py 
+
+"""
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.id_load_privkey_file("Acme_private.pem");
+ctxt.load_id(acmeID)
+acme=acmeID.id_keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.id_load_privkey_file("Coyote_private.pem");
+ctxt.load_id(coyoteID)
+coyote=coyoteID.id_keyid()
+
+warnerbrosID=ABAC.ID("WarnerBros_ID.pem");
+warnerbrosID.id_load_privkey_file("WarnerBros_private.pem");
+ctxt.load_id(warnerbrosID)
+warnerbros=warnerbrosID.id_keyid()
+
+batmanID=ABAC.ID("Batman_ID.pem");
+batmanID.id_load_privkey_file("Batman_private.pem");
+ctxt.load_id(batmanID)
+batman=batmanID.id_keyid()
+
+
+################################################
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+#                                    & [keyid:WarnerBros].role:charater
+head = ABAC.Role(acme,"buy_rockets")
+tail1 = ABAC.Role(acme,"preferred_customer")
+tail2 = ABAC.Role(warnerbros,"character")
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail1)
+attr.attribute_add_tail(tail2)
+attr.attribute_bake()
+attr.attribute_write_cert("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.der")
+ctxt.load_attribute_file("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+head = ABAC.Role(acme,"preferred_customer")
+tail = ABAC.Role(coyote)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Acme_preferred_customer__Coyote_attr.der")
+ctxt.load_attribute_file("Acme_preferred_customer__Coyote_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+#[keyid:Acme].role:preferred_customer <- [keyid:Batman]
+head = ABAC.Role(acme,"preferred_customer")
+tail = ABAC.Role(batman)
+attr=ABAC.Attribute(head,1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Acme_preferred_customer__Batman_attr.der")
+ctxt.load_attribute_file("Acme_preferred_customer__Batman_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+################################################
+#[keyid:WarnerBros].role:character <- [keyid:Coyote]
+head=ABAC.Role(warnerbros,"character")
+tail = ABAC.Role(coyote)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("WarnerBros_character__Coyote_attr.der")
+#ctxt.load_attribute_file("WarnerBros_character__Coyote_attr.der")
+ctxt.load_attribute(attr)
+#print attr.string() 
+#print attr.typed_string()
+#print "\n"
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/acme_rockets_intersection_rt0/intersect.save
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/intersect.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_rockets_intersection_rt0/intersect.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,26 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===good============ Acme.buy_rockets <- Coyote
+YAP query succeed
+pAcme.buy_rockets <- pAcme.preferred_customer & pWarnerBros.character
+pAcme.preferred_customer <- pCoyote
+pWarnerBros.character <- pCoyote
+
+===bad============ Acme.buy_rockets <- Batman
+YAP query failed
+
+...final principal set...
+(pAcme,keyid,y) 
+(pBatman,keyid,y) 
+(pCoyote,keyid,y) 
+(pWarnerBros,keyid,y) 
+
+
+
+...final policy attribute set...
+pAcme.buy_rockets <- pAcme.preferred_customer & pWarnerBros.character
+pAcme.preferred_customer <- pBatman
+pAcme.preferred_customer <- pCoyote
+pWarnerBros.character <- pCoyote
+
+
Index: examples/python_tests/acme_rockets_intersection_rt0/query.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,79 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.id_load_privkey_file("Acme_private.pem");
+acme=acmeID.id_keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.id_load_privkey_file("Coyote_private.pem");
+coyote=coyoteID.id_keyid()
+
+warnerbrosID=ABAC.ID("WarnerBros_ID.pem");
+warnerbrosID.id_load_privkey_file("WarnerBros_private.pem");
+warnerbros=warnerbrosID.id_keyid()
+
+batmanID=ABAC.ID("Batman_ID.pem");
+batmanID.id_load_privkey_file("Batman_private.pem");
+batman=batmanID.id_keyid()
+
+##########################################################################
+# role = "[keyid:Acme].role:buy_rockets"
+# p = "[keyid:coyote]" 
+role = ABAC.Role(acme,"buy_rockets")
+p = ABAC.Role(coyote)
+
+print "\n===good============ Acme.buy_rockets <- Coyote"
+out = ctxt.query(role, p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# role = "[keyid:Acme].role:buy_rockets"
+# p = "[keyid:batman]" 
+role = ABAC.Role(acme,"buy_rockets")
+p = ABAC.Role(batman)
+
+print "\n===bad============ Acme.buy_rockets <- Batman"
+out = ctxt.query(role, p)
+
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+
+
Index: examples/python_tests/acme_rockets_intersection_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,35 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > intersect.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>intersect.cn 2>&1
+
+result=`diff intersect.cn intersect.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:acme_rockets_intersection_rt0 test result differs!!!"
+    fi
+else
+    echo "   ERROR:acme_rockets_intersection_rt0 test result differs!!!"
+fi
+
+
Index: examples/python_tests/acme_rockets_intersection_rt0/setup.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,30 @@
+#!/usr/bin/env python
+
+"""
+  Setup 4 principal ID credentials
+
+  Acme, Coyote, WarnerBros and Batman
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+alpha=ABAC.ID("Acme", 0)
+alpha.id_write_cert("Acme_ID.pem")
+alpha.id_write_privkey("Acme_private.pem")
+
+coyote=ABAC.ID("Coyote", 0)
+coyote.id_write_cert("Coyote_ID.pem")
+coyote.id_write_privkey("Coyote_private.pem")
+
+warnerbros=ABAC.ID("WarnerBros", 0)
+warnerbros.id_write_cert("WarnerBros_ID.pem")
+warnerbros.id_write_privkey("WarnerBros_private.pem")
+
+batman=ABAC.ID("Batman", 0)
+batman.id_write_cert("Batman_ID.pem")
+batman.id_write_privkey("Batman_private.pem")
+
+
Index: examples/python_tests/allout.save
===================================================================
--- examples/python_tests/allout.save	(revision 5d06689e2b01138202c40932797284b0fcdf7603)
+++ examples/python_tests/allout.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -1,4 +1,36 @@
 
  ==> RUN on access_rt2
+---setup principals
+---setup attributes
+---run queries
+...with sha
+...with cn
+   PASSED
+
+ ==> RUN on acme_friend_rt1
+---setup principals
+---setup attributes
+---run queries
+...with sha
+...with cn
+   PASSED
+
+ ==> RUN on acme_rockets_intersection_rt0
+---setup principals
+---setup attributes
+---run queries
+...with sha
+...with cn
+   PASSED
+
+ ==> RUN on alumni3_rt1
+---setup principals
+---setup attributes
+---run queries
+...with sha
+...with cn
+   PASSED
+
+ ==> RUN on balltime_rt2
 ---setup principals
 ---setup attributes
@@ -13,2 +45,10 @@
 ---run with cn
    PASSED
+
+ ==> RUN on fruits_rt2
+---setup principals
+---setup attributes
+---run queries
+...with sha
+...with cn
+   PASSED
Index: examples/python_tests/alumni3_rt1/README
===================================================================
--- examples/python_tests/alumni3_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/alumni3_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,90 @@
+#!/bin/sh
+#
+# This example shows an example of reasoning about a role's parameters.  There
+# are 4 principals StateU, Bob, Mark, Maryann, Joe, and Jan.  StateU wants to
+# establish a set of founding alumni based on the year of graduation.  On
+# graduation each alum has previously been issued a credential parameterized
+# with their major and graduation year.  StateU sets up a policy that says that
+# a principal is a founding alum if they graduated in 1960, 1961, or 1963 in
+# either mathematics or psychology.  One assumes there was some kind of NCAA
+# suspension in 1962.  This policy is expressed in Credential 1.
+#
+# Credentials 2, 3, 4, 5, and 6 each assign a diploma credential to Bob (a 1961
+# mathematics degree), Mark (a 1965 mathematics degree), Joe (a 1961 zoology degree), Maryann (a 1962 psychology degree), and Jan (a 1960 psychology degree)
+#
+# The attached ./run_query file asks if each of these principals are favored
+# alums, and only Bob and Jan are.
+
+# alumni3_rt1_typed
+
+rm -rf *.der *.pem
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+
+creddy --generate --cn StateU
+creddy --generate --cn Bob
+creddy --generate --cn Mark
+creddy --generate --cn Joe
+creddy --generate --cn Maryann
+creddy --generate --cn Jan
+
+stateU_keyid=`creddy --keyid --cert StateU_ID.pem`
+
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+mark_keyid=`creddy --keyid --cert Mark_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+jan_keyid=`creddy --keyid --cert Jan_ID.pem`
+
+diploma_q_qY="diploma([string:?D:['mathmatics','psychology']], [integer:?Year:[1960,1961,1963]])"
+
+diploma_m="diploma([string:'mathmatics'],[integer:1961])"
+diploma_mm="diploma([string:'mathmatics'],[integer:1965])"
+diploma_z="diploma([string:'zoology'],[integer:1961])"
+diploma_p="diploma([string:'psychology'],[integer:1962])"
+diploma_pp="diploma([string:'psychology'],[integer:1960])"
+
+# [keyid:stateU].role:foundingAlumni 
+#                   <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']], [integer:?Year:[1960,1961,1963]])
+# Credential 1
+creddy --attribute \
+       --issuer StateU_ID.pem --key StateU_private.pem --role "foundingAlumni" \
+       --subject-cert StateU_ID.pem --subject-role "$diploma_q_qY" \
+       --out StateU_foundingAlumni__stateU_diploma_q_qY_attr.der
+
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
+# Credential 2
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_m" \
+        --subject-cert Bob_ID.pem \
+        --out StateU_diploma_m__Bob_attr.der
+
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
+# Credential 3
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_mm" \
+        --subject-cert Mark_ID.pem \
+        --out StateU_diploma_mm__Mark_attr.der
+
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
+# Credential 4
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_z" \
+        --subject-cert Joe_ID.pem \
+        --out StateU_diploma_z__Joe_attr.der
+
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
+# Credential 5
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_p" \
+        --subject-cert Maryann_ID.pem \
+        --out StateU_diploma_p__Maryann_attr.der
+
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960]) <- [keyid:jan]
+# Credential 6
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_pp" \
+        --subject-cert Jan_ID.pem \
+        --out StateU_diploma_pp__Jan_attr.der
+
Index: examples/python_tests/alumni3_rt1/alumni3.save
===================================================================
--- examples/python_tests/alumni3_rt1/alumni3.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/alumni3_rt1/alumni3.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,40 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===good============ stateU.foundingAlumni <- Bob
+YAP query succeed
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('mathmatics',1961) <- pBob
+
+===bad============ stateU.foundingAlumni <- Mark
+YAP query failed
+
+===bad============ stateU.foundingAlumni <- Joe
+YAP query failed
+
+===bad============ stateU.foundingAlumni <- Maryann
+YAP query failed
+
+===good============ stateU.foundingAlumni <- Jan
+YAP query succeed
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+pStateU.diploma('psychology',1960) <- pJan
+
+...final principal set...
+(pBob,keyid,y) 
+(pJan,keyid,y) 
+(pJoe,keyid,y) 
+(pMark,keyid,y) 
+(pMaryann,keyid,y) 
+(pStateU,keyid,y) 
+
+
+
+...final policy attribute set...
+pStateU.diploma('mathmatics',1961) <- pBob
+pStateU.diploma('mathmatics',1965) <- pMark
+pStateU.diploma('psychology',1960) <- pJan
+pStateU.diploma('psychology',1962) <- pMaryann
+pStateU.diploma('zoology',1961) <- pJoe
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
+
+
Index: examples/python_tests/alumni3_rt1/attr.py
===================================================================
--- examples/python_tests/alumni3_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/alumni3_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,171 @@
+#!/usr/bin/env python
+
+"""
+  Setup access policy attribute rules
+
+cmd1:env keystore=`pwd` ./attr.py 
+
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+stateUID=ABAC.ID("StateU_ID.pem")
+stateUID.id_load_privkey_file("StateU_private.pem")
+stateU=stateUID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bobID.id_load_privkey_file("Bob_private.pem")
+bob=bobID.id_keyid()
+
+markID=ABAC.ID("Mark_ID.pem")
+markID.id_load_privkey_file("Mark_private.pem")
+mark=markID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem")
+joeID.id_load_privkey_file("Joe_private.pem")
+joe=joeID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem")
+maryannID.id_load_privkey_file("Maryann_private.pem")
+maryann=maryannID.id_keyid()
+
+janID=ABAC.ID("Jan_ID.pem")
+janID.id_load_privkey_file("Jan_private.pem")
+jan=janID.id_keyid()
+
+
+################################################
+# [keyid:stateU].role:foundingAlumni
+#              <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']],
+#                                             [integer:?Year:[1960,1961,1963]])
+head = ABAC.Role(stateU,"foundingAlumni")
+cond=ABAC.Constraint("string")
+cond.constraint_add_string_target("'mathmatics'")
+cond.constraint_add_string_target("'psychology'")
+param1=ABAC.DataTerm("string", "D", cond)
+cond=ABAC.Constraint("integer")
+cond.constraint_add_integer_target(1960)
+cond.constraint_add_integer_target(1961)
+cond.constraint_add_integer_target(1963)
+param2=ABAC.DataTerm("integer", "Year", cond)
+tail = ABAC.Role(stateU,"diploma")
+tail.role_add_data_term(param1)
+tail.role_add_data_term(param2)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
+ctxt.load_attribute_file("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
+param1=ABAC.DataTerm("string", "'mathmatics'")
+param2=ABAC.DataTerm("integer", "1961")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_m__Bob_attr.der")
+ctxt.load_attribute_file("StateU_diploma_m__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
+param1=ABAC.DataTerm("string", "'mathmatics'")
+param2=ABAC.DataTerm("integer", "1965")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(mark)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_m__Mark_attr.der")
+ctxt.load_attribute_file("StateU_diploma_m__Mark_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
+param1=ABAC.DataTerm("string", "'zoology'")
+param2=ABAC.DataTerm("integer", "1961")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_z__Joe_attr.der")
+ctxt.load_attribute_file("StateU_diploma_z__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
+param1=ABAC.DataTerm("string", "'psychology'")
+param2=ABAC.DataTerm("integer", "1962")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(maryann)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_p__Maryann_attr.der")
+ctxt.load_attribute_file("StateU_diploma_p__Maryann_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+#################################################
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960]) <- [keyid:jan]
+param1=ABAC.DataTerm("string", "'psychology'")
+param2=ABAC.DataTerm("integer", "1960")
+head = ABAC.Role(stateU,"diploma")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+tail = ABAC.Role(jan)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("StateU_diploma_p__Jan_attr.der")
+ctxt.load_attribute_file("StateU_diploma_p__Maryann_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/alumni3_rt1/query.py
===================================================================
--- examples/python_tests/alumni3_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/alumni3_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,111 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+stateUID=ABAC.ID("StateU_ID.pem")
+stateUID.id_load_privkey_file("StateU_private.pem")
+stateU=stateUID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem")
+bobID.id_load_privkey_file("Bob_private.pem")
+bob=bobID.id_keyid()
+
+markID=ABAC.ID("Mark_ID.pem")
+markID.id_load_privkey_file("Mark_private.pem")
+mark=markID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem")
+joeID.id_load_privkey_file("Joe_private.pem")
+joe=joeID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem")
+maryannID.id_load_privkey_file("Maryann_private.pem")
+maryann=maryannID.id_keyid()
+
+janID=ABAC.ID("Jan_ID.pem")
+janID.id_load_privkey_file("Jan_private.pem")
+jan=janID.id_keyid()
+
+##########################################################################
+# role=[keyid:stateU].role:foundingAlumni
+# p=[keyid:Bob] 
+role = ABAC.Role(stateU,"foundingAlumni")
+p = ABAC.Role(bob)
+print "\n===good============ stateU.foundingAlumni <- Bob"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:stateU].role:foundingAlumni
+# p=[keyid:Mark] 
+role = ABAC.Role(stateU,"foundingAlumni")
+p = ABAC.Role(mark)
+print "\n===bad============ stateU.foundingAlumni <- Mark"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:stateU].role:foundingAlumni
+# p=[keyid:Joe] 
+role = ABAC.Role(stateU,"foundingAlumni")
+p = ABAC.Role(joe)
+print "\n===bad============ stateU.foundingAlumni <- Joe"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:stateU].role:foundingAlumni
+# p=[keyid:Maryann] 
+role = ABAC.Role(stateU,"foundingAlumni")
+p = ABAC.Role(maryann)
+print "\n===bad============ stateU.foundingAlumni <- Maryann"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:stateU].role:foundingAlumni
+# p=[keyid:Jan] 
+role = ABAC.Role(stateU,"foundingAlumni")
+p = ABAC.Role(jan)
+print "\n===good============ stateU.foundingAlumni <- Jan"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+
Index: examples/python_tests/alumni3_rt1/run_test
===================================================================
--- examples/python_tests/alumni3_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/alumni3_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,37 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+rm -rf *.der *.pem
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > alumni3.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>alumni3.cn 2>&1
+
+result=`diff alumni3.cn alumni3.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:alumni3_rt1 test result differs!!!"
+    fi
+else
+    echo "   ERROR:alumni3_rt1 test result differs!!!"
+fi
+
+
Index: examples/python_tests/alumni3_rt1/setup.py
===================================================================
--- examples/python_tests/alumni3_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/alumni3_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,37 @@
+#!/usr/bin/env python
+
+"""
+  Setup 4 principal ID credentials
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+stateU=ABAC.ID("StateU", 0)
+stateU.id_write_cert("StateU_ID.pem")
+stateU.id_write_privkey("StateU_private.pem")
+
+bob=ABAC.ID("Bob", 0)
+bob.id_write_cert("Bob_ID.pem")
+bob.id_write_privkey("Bob_private.pem")
+
+mark=ABAC.ID("Mark", 0)
+mark.id_write_cert("Mark_ID.pem")
+mark.id_write_privkey("Mark_private.pem")
+
+joe=ABAC.ID("Joe", 0)
+joe.id_write_cert("Joe_ID.pem")
+joe.id_write_privkey("Joe_private.pem")
+
+maryann=ABAC.ID("Maryann", 0)
+maryann.id_write_cert("Maryann_ID.pem")
+maryann.id_write_privkey("Maryann_private.pem")
+
+jan=ABAC.ID("Jan", 0)
+jan.id_write_cert("Jan_ID.pem")
+jan.id_write_privkey("Jan_private.pem")
+
+
+
Index: examples/python_tests/balltime_rt2/README
===================================================================
--- examples/python_tests/balltime_rt2/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/balltime_rt2/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,121 @@
+#!/bin/sh
+#
+#####################################################################
+# This example demonstrates using an oset (object set) to control access
+# to files based on the attributes of the principals.  The script creates
+# three principals League, John and Mark and sets out the access policy.
+# 
+# files are named by URNs and are not principals.
+# 
+# A principal's access rights are controlled by the League principal.  If a 
+# principal has the role role::stadium(string:'access',boolean:true,time:now)
+# that  principal can go into stadium if principal's team has a scheduled 
+# gametime.  A principal is in team's roster if it is in
+# the oset of players(team) defined by League, written
+# [keyid:League].oset:players(string:'north'))
+# 
+# The example below lays out the policy that players of a given team can
+# go to the stadium when it is their team's gametime -- credential 1.
+# or any player of a team that is controlled by the League principal can
+# go to the stadium during stadium's free for all time -- credential 2.
+#
+# Credentials 3 & 4 establish the afernoon gametimes for team(north) 
+# and for team(south)
+# Credentials 5 & 6 establish John as player of team(north) and Mark as
+# a player for team(south)
+#
+# The attached ./run_query file runs 3 queries.  First it confirms that John can 
+# go to stadium at his team's gametime, then it confirms that Mark cannot
+# go because it is not his gametime, but Mark can go to the stadium during
+# stadium's free-for-all early morning time
+
+# balltime_rt2_typed
+
+creddy --generate --cn League
+creddy --generate --cn John
+creddy --generate --cn Mark
+
+league_keyid=`creddy --keyid --cert League_ID.pem`
+john_keyid=`creddy --keyid --cert John_ID.pem`
+mark_keyid=`creddy --keyid --cert Mark_ID.pem`
+
+stadium_qFqT="stadium([string:'access'],[boolean:true],[time:?F[keyid:$league_keyid].oset:gametime([string:?T])])"
+stadium_qR="stadium([string:'access'],[boolean:?B:[true]],[time:?F:[20120228T080000..20120228T090000]])"
+
+players_qT="players([string:?T])" 
+
+#[keyid:league].role:stadium([string:'access'],[boolean:true],
+#          [time:?F:[keyid:league].oset.gametime([string:?T])])
+#                <-[keyid:league].role:players([string:?T])
+# Credential 1
+creddy --attribute \
+       --issuer League_ID.pem --key League_private.pem --role "$stadium_qFqT" \
+       --subject-cert League_ID.pem --subject-role "$players_qT" \
+       --out League_access_qFqT__League_players_qT_attr.der
+
+#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
+#              [time:?F:[20120228T080000..20120228T090000]])
+#               <- [keyid:league].role:players(string:?T) 
+# Credential 2 
+creddy --attribute \
+       --issuer League_ID.pem --key League_private.pem --role "$stadium_qR" \
+       --subject-cert League_ID.pem --subject-role "$players_qT" \
+       --out League_access_qR__League_players_qT_attr.der
+
+
+# [keyid:league].oset:gametime([time:20120228T130000])
+#                    <- [keyid:league].oset:players([string:'north') 
+# Credential 3
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --oset "gametime([string:'north'])" \
+        --subject-obj "[time:20120228T130000]" \
+        --out League_gametime_north__timeT_attr.der
+
+# [keyid:league].oset:gametime([time:20120228T140000])
+#                    <- [keyid:league].oset:players([string:'south') 
+# Credential 4 
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --oset "gametime([string:'south'])" \
+        --subject-obj "[time:20120228T140000]" \
+        --out League_gametime_south__time2T_attr.der
+
+# [keyid:league].role:players([string:'north'])<-[keyid:John]
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --role "players([string:'north'])" \
+        --subject-cert John_ID.pem \
+        --out League_players_north__John_attr.der
+
+# [keyid:league].role:players([string:'south'])<-[keyid:Mark]
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --role "players([string:'south'])" \
+        --subject-cert Mark_ID.pem \
+        --out League_players_south__Mark_attr.der
+
+#####################################################################
+#league allows member of a team to access stadium at their team's designed time
+#
+#[keyid:league].role:stadium([string:'access'],[boolean:true],
+#          [time:?F:[keyid:league].oset.gametime([string:?T])])
+#                <-[keyid:league].role:players([string:?T])
+#
+#[keyid:league].role:stadium([string:'access'],[time:?Tm]) <- [principal:?P]
+#[keyid:league].oset:gametime(string:?Team) <- [time:?Tm]
+#[keyid:league].role:player(string:?Team) <- [principal:?P]
+#
+#
+#league.stadium(access,?Time:league.gametime(?Team)) <- league.players(?Teams)
+#              league.player(north) <- john
+#              league.player(south) <- mark 
+#              league.gametime(north) <- [time:'20120228T130000']
+#              league.gametime(south) <- [time:'20120228T140000']
+#
+#league.statdium(access,?FreeTime:[20120228T080000..20120228T090000]) 
+#                  <- league.players(_).
+#
+#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true]],
+#              [time:?F:['20120228T080000'..'20120228T090000']])
+#               <- [keyid:league].role:players(string:?T) 
Index: examples/python_tests/balltime_rt2/attr.py
===================================================================
--- examples/python_tests/balltime_rt2/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/balltime_rt2/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,167 @@
+#!/usr/bin/env python
+
+"""
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+leagueID=ABAC.ID("League_ID.pem");
+leagueID.id_load_privkey_file("League_private.pem");
+league=leagueID.id_keyid()
+
+johnID=ABAC.ID("John_ID.pem");
+johnID.id_load_privkey_file("John_private.pem");
+john=johnID.id_keyid()
+
+markID=ABAC.ID("Mark_ID.pem");
+markID.id_load_privkey_file("Mark_private.pem");
+mark=markID.id_keyid()
+
+################################################
+#[keyid:league].role:stadium([string:'access'],[boolean:true],
+#          [time:?F:[keyid:league].oset.gametime([string:?T])])
+#                <-[keyid:league].role:players([string:?T])
+param1=ABAC.DataTerm("string","'access'")
+param2=ABAC.DataTerm("boolean","true")
+
+param=ABAC.DataTerm("string","T")
+condoset=ABAC.Oset(league,"gametime")
+condoset.oset_add_data_term(param)
+cond=ABAC.Constraint(condoset)
+param3=ABAC.DataTerm("time", "F", cond)
+head = ABAC.Role(league,"stadium")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+head.role_add_data_term(param3)
+
+param=ABAC.DataTerm("string", "T")
+tail = ABAC.Role(league,"players")
+tail.role_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("League_access_qFqT__League_players_qT_attr.der")
+ctxt.load_attribute_file("League_access_qFqT__League_players_qT_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+################################################
+# ??? not sure if this is a valid policy
+#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
+#              [time:?F:[20120228T080000..20120228T090000]])
+#               <- [keyid:league].role:players(string:?T)
+param1=ABAC.DataTerm("string","'access'")
+cond=ABAC.Constraint("boolean")
+cond.constraint_add_boolean_target("true")
+param2=ABAC.DataTerm("boolean", "B", cond)
+cond=ABAC.Constraint("time")
+cond.constraint_add_time_min("20120228T080000")
+cond.constraint_add_time_max("20120228T090000")
+param3=ABAC.DataTerm("time", "F", cond)
+head = ABAC.Role(league,"stadium")
+head.role_add_data_term(param1)
+head.role_add_data_term(param2)
+head.role_add_data_term(param3)
+
+param=ABAC.DataTerm("string", "T")
+tail = ABAC.Role(league,"players")
+tail.role_add_data_term(param)
+
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("League_access_qR__League_players_qT_attr.der")
+ctxt.load_attribute_file("League_access_qR__League_players_qT_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:league].oset:gametime([string:'north'])
+#                    <- [time:20120228T130000]
+param=ABAC.DataTerm("string","'north'")
+head = ABAC.Oset(league,"gametime")
+head.oset_add_data_term(param)
+term=ABAC.DataTerm("time", "20120228T130000")
+tail = ABAC.Oset(term)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("League_gametime_north__timeT_attr.der")
+ctxt.load_attribute_file("League_gametime_north__timeT_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:league].oset:gametime([string:'south']) 
+#                    <-[time:20120228T140000]
+param=ABAC.DataTerm("string","'south'")
+head = ABAC.Oset(league,"gametime")
+head.oset_add_data_term(param)
+term=ABAC.DataTerm("time", "20120228T140000")
+tail = ABAC.Oset(term)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("League_gametime_south__time2T_attr.der")
+ctxt.load_attribute_file("League_gametime_south__time2T_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:league].role:players([string:'north'])<-[keyid:John]
+param=ABAC.DataTerm("string", "'north'")
+head = ABAC.Role(league,"players")
+head.role_add_data_term(param)
+tail = ABAC.Role(john)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("League_players_north__John_attr.der")
+ctxt.load_attribute_file("League_players_north__John_attr.der")
+print attr.string()
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:league].role:players([string:'south'])<-[keyid:Mark]
+param=ABAC.DataTerm("string", "'south'")
+head = ABAC.Role(league,"players")
+head.role_add_data_term(param)
+tail = ABAC.Role(mark)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("League_players_south__Mark_attr.der")
+ctxt.load_attribute_file("League_players_north__John_attr.der")
+print attr.string()
+print attr.typed_string()
+print "\n"
+
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/balltime_rt2/ball.save
===================================================================
--- examples/python_tests/balltime_rt2/ball.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/balltime_rt2/ball.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,32 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+  
+===good============ league.stadium(access,true,20120128T130000)<-?-john
+YAP query succeed
+pLeague.stadium('access',true,F:pLeague.gametime(T)) <- pLeague.players(T)
+pLeague.gametime('north') <- time(2012,02,28,13,00,00)
+pLeague.players('north') <- pJohn
+
+===bad============ league.stadium(access,true,20120128T110000)<-?-mark
+YAP query failed
+
+===good============ league.stadium(access,true,20120128T080000)<-?-mark
+YAP query succeed
+pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
+pLeague.players('south') <- pMark
+
+...final principal set...
+(pJohn,keyid,y) 
+(pLeague,keyid,y) 
+(pMark,keyid,y) 
+
+
+
+...final policy attribute set...
+pLeague.stadium('access',true,F:pLeague.gametime(T)) <- pLeague.players(T)
+pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
+pLeague.gametime('north') <- time(2012,02,28,13,00,00)
+pLeague.gametime('south') <- time(2012,02,28,14,00,00)
+pLeague.players('north') <- pJohn
+pLeague.players('south') <- pMark
+
+
Index: examples/python_tests/balltime_rt2/query.py
===================================================================
--- examples/python_tests/balltime_rt2/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/balltime_rt2/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,100 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+leagueID=ABAC.ID("League_ID.pem");
+leagueID.id_load_privkey_file("League_private.pem");
+league=leagueID.id_keyid()
+
+johnID=ABAC.ID("John_ID.pem");
+johnID.id_load_privkey_file("John_private.pem");
+john=johnID.id_keyid()
+
+markID=ABAC.ID("Mark_ID.pem");
+markID.id_load_privkey_file("Mark_private.pem");
+mark=markID.id_keyid()
+
+##########################################################################
+# role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T130000]) 
+# p=[keyid:john]
+param1=ABAC.DataTerm("string", "'access'")
+param2=ABAC.DataTerm("boolean", "true")
+param3=ABAC.DataTerm("time", "20120228T130000")
+role = ABAC.Role(league,"stadium")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+role.role_add_data_term(param3)
+p=ABAC.Role(john)
+print "\n===good============ league.stadium(access,true,20120128T130000)<-?-john"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T110000]) 
+# p=[keyid:mark]
+param1=ABAC.DataTerm("string", "'access'")
+param2=ABAC.DataTerm("boolean", "true")
+param3=ABAC.DataTerm("time", "20120228T110000")
+role = ABAC.Role(league,"stadium")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+role.role_add_data_term(param3)
+p=ABAC.Role(mark)
+print "\n===bad============ league.stadium(access,true,20120128T110000)<-?-mark"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T080000])
+# p=[keyid:mark]
+param1=ABAC.DataTerm("string", "'access'")
+param2=ABAC.DataTerm("boolean", "true")
+param3=ABAC.DataTerm("time", "20120228T080000")
+role = ABAC.Role(league,"stadium")
+role.role_add_data_term(param1)
+role.role_add_data_term(param2)
+role.role_add_data_term(param3)
+p=ABAC.Role(mark)
+print "\n===good============ league.stadium(access,true,20120128T080000)<-?-mark"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# dump the yap dB
+#
+#ctxt.dump_yap_db()
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
Index: examples/python_tests/balltime_rt2/run_test
===================================================================
--- examples/python_tests/balltime_rt2/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/balltime_rt2/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,37 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+rm -rf *.der *.pem
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > ball.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>ball.cn 2>&1
+
+result=`diff ball.cn ball.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:balltime_rt2 test result differs!!!"
+    fi
+else
+    echo "   ERROR:balltime_rt2 test result differs!!!"
+fi
+
+
Index: examples/python_tests/balltime_rt2/setup.py
===================================================================
--- examples/python_tests/balltime_rt2/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/balltime_rt2/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+
+"""
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+leagueID=ABAC.ID("League", 0)
+leagueID.id_write_cert("League_ID.pem")
+leagueID.id_write_privkey("League_private.pem")
+
+johnID=ABAC.ID("John", 0)
+johnID.id_write_cert("John_ID.pem")
+johnID.id_write_privkey("John_private.pem")
+
+markID=ABAC.ID("Mark", 0)
+markID.id_write_cert("Mark_ID.pem")
+markID.id_write_privkey("Mark_private.pem")
+
Index: examples/python_tests/fruits_rt2/README
===================================================================
--- examples/python_tests/fruits_rt2/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/fruits_rt2/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,111 @@
+#!/bin/sh
+#
+# This demonstrates assigning objects to object sets (osets) based on their
+# membership in other sets.  In this case there are 3 prinicpals. Mary and Bob
+# are encoding what fruits they are willing to eat in the oset Bob.what2eat and
+# Mary.what2eat.  Ralphs is defining the prices of the fruits it sells by
+# assigning them to osets parameterized by price.
+#
+# Credential 1 lays out Mary's policy - she will eat fruits that cost less that
+# or equal to 2.00.  Bob will eat fruits that cost between 1.00 and 5.00, as
+# laid out in Credential 2.  Strictly speaking Bob and Mary's ruls apply to
+# prices assigned by Ralphs.  Credentials 3-6 are Ralph's price assignments:
+# 
+# Fruit               Price      Credential
+# apple               1.50       3
+# kiwi                1.50       4
+# black rsaberry      2.50       5
+# navel ornage        0.50       6
+#
+# The attached ./run_query file proves that Mary will eat a naval orange and a kiwi,
+# and that Bob will not eat a navel orange (too cheap).  It also proves a apple
+# is priced at 1.50 and that it cannot prove that a green apple is priced at
+# 1.50 (we don't know anything about green apples).
+
+# fruits_rt2_typed
+
+# mary.what2eat<-?-navel orange  good
+# mary.what2eat<-?-kiwi  good
+# bob.what2eat<-?-navel orange  bad
+# ralphs.fruitprice(1.50)<-?-apple   good
+# ralphs.fruitprice(1.50)<-?-green apple   bad
+
+creddy --generate --cn Mary
+creddy --generate --cn Bob
+creddy --generate --cn Ralphs
+
+mary_keyid=`creddy --keyid --cert Mary_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+ralphs_keyid=`creddy --keyid --cert Ralphs_ID.pem`
+
+fruitprice_qP="fruitprice([float:?P:[..2.00]])"
+fruitprice_qP_2="fruitprice([float:?P:[1.00..5.00]])"
+
+# [keyid:mary].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
+# Credential 1
+creddy --attribute \
+       --issuer Mary_ID.pem --key Mary_private.pem --oset "what2eat" \
+       --subject-cert Ralphs_ID.pem --subject-oset "$fruitprice_qP" \
+       --out mary_what2eat__ralphs_fruitprice_qP_attr.der
+
+# [keyid:bob].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
+# Credential 2
+creddy --attribute \
+       --issuer Bob_ID.pem --key Bob_private.pem --oset "what2eat" \
+       --subject-cert Ralphs_ID.pem --subject-oset "$fruitprice_qP_2" \
+       --out bob_what2eat__ralphs_fruitprice_qP_2_attr.der
+
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
+# Credential 3
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:1.50])" \
+        --subject-obj "[string:'apple']" \
+        --out Ralphs_fruitprice__apple_attr.der
+
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'kiwi']
+# Credential 4
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:1.50])" \
+        --subject-obj "[string:'kiwi']" \
+        --out Ralphs_fruitprice__kiwi_attr.der
+
+
+# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black rasberry']
+# Credential 5
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:2.50])" \
+        --subject-obj "[string:'black rasberry']" \
+        --out Ralphs_fruitprice__black_rasberry_attr.der
+
+# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
+# Credential 6
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:0.50])" \
+        --subject-obj "[string:'navel orange']" \
+        --out Ralphs_fruitprice__navel_orange_attr.der
+
+#####################################################################
+# mary.what2eat <- ralphs.fruitsprice(?P:[..2.00])
+# [keyid:mary].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
+#
+# bob.what2eat <- ralphs.fruitsprice(?P:[1.00..5.00])
+# [keyid:bob].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
+# 
+# ralphs.fruitprice(1.50)<-apple
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
+#
+# ralphs.fruitprice(2.50)<-black rasberry
+# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black rasberry']
+#
+# ralphs.fruitprice(0.50)<-navel orange
+# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
+# 
+
Index: examples/python_tests/fruits_rt2/attr.py
===================================================================
--- examples/python_tests/fruits_rt2/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/fruits_rt2/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,146 @@
+#!/usr/bin/env python
+
+"""
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+ralphsID=ABAC.ID("Ralphs_ID.pem");
+ralphsID.id_load_privkey_file("Ralphs_private.pem");
+ralphs=ralphsID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+maryID=ABAC.ID("Mary_ID.pem");
+maryID.id_load_privkey_file("Mary_private.pem");
+mary=maryID.id_keyid()
+
+################################################
+# [keyid:mary].oset:what2eat
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
+# [keyid:alpha].role:access([string:'Read'],[urn:'file//fileB']) <- [keyid:bob]
+head = ABAC.Oset(mary,"what2eat")
+cond=ABAC.Constraint("float")
+cond.constraint_add_float_max(2.00)
+param=ABAC.DataTerm("float", "P", cond)
+tail = ABAC.Oset(ralphs,"fruitprice")
+tail.oset_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("mary_what2eat__ralphs_fruitprice_qP_attr.der")
+ctxt.load_attribute_file("mary_what2eat__ralphs_fruitprice_qP_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+################################################
+# [keyid:bob].oset:what2eat
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
+head = ABAC.Oset(bob,"what2eat")
+cond=ABAC.Constraint("float")
+cond.constraint_add_float_min(1.00)
+cond.constraint_add_float_max(5.00)
+print cond.typed_string()
+param=ABAC.DataTerm("float", "P", cond)
+tail = ABAC.Oset(ralphs,"fruitprice")
+tail.oset_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("bob_what2eat__ralphs_fruitprice_qP_attr.der")
+ctxt.load_attribute_file("bob_what2eat__ralphs_fruitprice_qP_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
+param=ABAC.DataTerm("float", "1.50")
+head = ABAC.Oset(ralphs,"fruitprice")
+head.oset_add_data_term(param)
+param=ABAC.DataTerm("string", "'apple'")
+tail = ABAC.Oset(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Ralphs_fruitprice__apple_attr.der")
+ctxt.load_attribute_file("Ralphs_fruitprice__apple_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'kiwi']
+param=ABAC.DataTerm("float", "1.50")
+head = ABAC.Oset(ralphs,"fruitprice")
+head.oset_add_data_term(param)
+param=ABAC.DataTerm("string", "'kiwi'")
+tail = ABAC.Oset(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Ralphs_fruitprice__kiwi_attr.der")
+ctxt.load_attribute_file("Ralphs_fruitprice__kiwi_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black berry']
+param=ABAC.DataTerm("float", "2.50")
+head = ABAC.Oset(ralphs,"fruitprice")
+head.oset_add_data_term(param)
+param=ABAC.DataTerm("string", "'black berry'")
+tail = ABAC.Oset(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Ralphs_fruitprice__blackberry_attr.der")
+ctxt.load_attribute_file("Ralphs_fruitprice__blackberry_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
+param=ABAC.DataTerm("float", "0.50")
+head = ABAC.Oset(ralphs,"fruitprice")
+head.oset_add_data_term(param)
+param=ABAC.DataTerm("string", "'navel orange'")
+tail = ABAC.Oset(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Ralphs_fruitprice__navelorange_attr.der")
+ctxt.load_attribute_file("Ralphs_fruitprice__navelorange_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+##
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/fruits_rt2/fruit.save
===================================================================
--- examples/python_tests/fruits_rt2/fruit.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/fruits_rt2/fruit.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,38 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+   
+===good============ mary.what2eat <- navel orange
+YAP query succeed
+pMary.what2eat <- pRalphs.fruitprice(P:[.. 2.000000])
+pRalphs.fruitprice(0.50) <- 'navel orange'
+
+===good============ mary.what2eat <- kiwi
+YAP query succeed
+pMary.what2eat <- pRalphs.fruitprice(P:[.. 2.000000])
+pRalphs.fruitprice(1.50) <- 'kiwi'
+
+===bad============ bob.what2eat <- navel orange
+YAP query failed
+
+===good============ ralphs.fruitprice(1.50) <- apple
+YAP query succeed
+pRalphs.fruitprice(1.50) <- 'apple'
+
+===bad============ ralphs.fruitprice(1.50) <- green apple
+YAP query failed
+
+...final principal set...
+(pBob,keyid,y) 
+(pMary,keyid,y) 
+(pRalphs,keyid,y) 
+
+
+
+...final policy attribute set...
+pRalphs.fruitprice(1.50) <- 'apple'
+pRalphs.fruitprice(2.50) <- 'black berry'
+pRalphs.fruitprice(1.50) <- 'kiwi'
+pRalphs.fruitprice(0.50) <- 'navel orange'
+pBob.what2eat <- pRalphs.fruitprice(P:[1.000000 .. 5.000000])
+pMary.what2eat <- pRalphs.fruitprice(P:[.. 2.000000])
+
+
Index: examples/python_tests/fruits_rt2/query.py
===================================================================
--- examples/python_tests/fruits_rt2/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/fruits_rt2/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,118 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+ralphsID=ABAC.ID("Ralphs_ID.pem");
+ralphsID.id_load_privkey_file("Ralphs_private.pem");
+ralphs=ralphsID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+maryID=ABAC.ID("Mary_ID.pem");
+maryID.id_load_privkey_file("Mary_private.pem");
+mary=maryID.id_keyid()
+
+##########################################################################
+# oset = [keyid:mary].oset:what2eat 
+# p [string:'navel orange'] 
+oset = ABAC.Oset(mary,"what2eat")
+term=ABAC.DataTerm("string", "'navel orange'")
+p = ABAC.Oset(term)
+
+print "\n===good============ mary.what2eat <- navel orange"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# oset = [keyid:mary].oset:what2eat 
+# p [string:'kiwi'] 
+oset = ABAC.Oset(mary,"what2eat")
+term=ABAC.DataTerm("string", "'kiwi'")
+p = ABAC.Oset(term)
+
+print "\n===good============ mary.what2eat <- kiwi"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# oset = [keyid:bob].oset:what2eat 
+# p [string:'navel orange'] 
+oset = ABAC.Oset(bob,"what2eat")
+term=ABAC.DataTerm("string", "'navel orange'")
+p = ABAC.Oset(term)
+
+print "\n===bad============ bob.what2eat <- navel orange"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# oset = [keyid:$ralphs].oset:fruitprice([float:1.50]) 
+# p = [string:'apple'] 
+param=ABAC.DataTerm("float", "1.50")
+oset = ABAC.Oset(ralphs,"fruitprice")
+oset.oset_add_data_term(param)
+term=ABAC.DataTerm("string", "'apple'")
+p = ABAC.Oset(term)
+
+print "\n===good============ ralphs.fruitprice(1.50) <- apple"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# oset = [keyid:$ralphs].oset:fruitprice([float:1.50]) 
+# p = [string:'green apple'] 
+param=ABAC.DataTerm("float", "1.50")
+oset = ABAC.Oset(ralphs,"fruitprice")
+oset.oset_add_data_term(param)
+term=ABAC.DataTerm("string", "'green apple'")
+p = ABAC.Oset(term)
+
+print "\n===bad============ ralphs.fruitprice(1.50) <- green apple"
+out = ctxt.query(oset, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# dump the yap dB
+#
+#ctxt.dump_yap_db()
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+
+
Index: examples/python_tests/fruits_rt2/run_test
===================================================================
--- examples/python_tests/fruits_rt2/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/fruits_rt2/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,35 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > fruit.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>fruit.cn 2>&1
+
+result=`diff fruit.cn fruit.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:fruits_rt2 test result differs!!!"
+    fi
+else
+    echo "   ERROR:fruits_rt2 test result differs!!!"
+fi
+
+
Index: examples/python_tests/fruits_rt2/setup.py
===================================================================
--- examples/python_tests/fruits_rt2/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/fruits_rt2/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+
+"""
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+ralphsID=ABAC.ID("Ralphs", 0)
+ralphsID.id_write_cert("Ralphs_ID.pem")
+ralphsID.id_write_privkey("Ralphs_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.id_write_cert("Bob_ID.pem")
+bobID.id_write_privkey("Bob_private.pem")
+
+maryID=ABAC.ID("Mary", 0)
+maryID.id_write_cert("Mary_ID.pem")
+maryID.id_write_privkey("Mary_private.pem")
Index: examples/python_tests/leader_rt1/README
===================================================================
--- examples/python_tests/leader_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,68 @@
+#!/bin/sh
+#
+# This example shows a way to allow an user with multiple keyid identities 
+# to be 'reasoned' as one within a single scope.  There are 4 principals 
+# Geni, Bob, Jack, and Joe. Bob and Joe are actually the same person but 
+# not Jack.
+#
+# Credentials 1 is the policy that says a principal is a group leader
+# at Geni if it is equivalent to another principal who is a group 
+# leader at Geni. 
+#
+# Credentials 2 establishes Bob as a group leader at Geni while
+# credential 3 and 4 are the equivalent rules between Bob and Joe.
+#
+# The attached ./run_query file asks if Joe is also an group leader which
+# he is because there is a equivalent rule from Bob to him. It also asks
+# if Jack is a group leader which he isn't because there is no equivalent
+# rule from Bob to him.
+
+# leader_rt1_typed
+
+# [keyid:geni].role:leader <-?- [keyid:Bob] (yes)
+# [keyid:geni].role:leader <-?- [keyid:Jack] (no)
+# [keyid:geni].role:leader <-?- [keyid:Joe] (yes)
+
+creddy --generate --cn Geni
+creddy --generate --cn Bob
+creddy --generate --cn Jack
+creddy --generate --cn Joe
+
+geni_keyid=`creddy --keyid --cert Geni_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+jack_keyid=`creddy --keyid --cert Jack_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+leader_qP="equivalent([principal:?P[keyid:$geni_keyid].role:leader])"
+equivalent_bob="equivalent([keyid:$bob_keyid])"
+equivalent_joe="equivalent([keyid:$joe_keyid])"
+
+# [keyid:geni].role:leader 
+#         <- [keyid:geni].role:equivalent([principal:?P[keyid:geni].role:leader])
+# Credential 1
+/home/mei/Deter/abac/creddy/creddy --attribute \
+       --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
+       --subject-cert Geni_ID.pem --subject-role "$leader_qP" \
+       --out geni_leader__geni_leader_qP_attr.der
+
+# [keyid:geni].role:leader <- [keyid:bob]
+# Credential 2
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
+        --subject-cert Bob_ID.pem \
+        --out geni_leader__Bob_attr.der
+
+# [keyid:geni].role:equivalent([keyid:bob]) <- [keyid:Joe]
+# Credential 3
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_bob" \
+        --subject-cert Joe_ID.pem \
+        --out geni_equivalent_Bob__Joe_attr.der
+
+# [keyid:geni].role:equivalent([keyid:Joe]) <- [keyid:Bob]
+# Credential 4
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_joe" \
+        --subject-cert Bob_ID.pem \
+        --out geni_equivalent_Joe__Bob_attr.der
+
Index: examples/python_tests/leader_rt1/attr.py
===================================================================
--- examples/python_tests/leader_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,151 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+geniID=ABAC.ID("Geni_ID.pem");
+geniID.id_load_privkey_file("Geni_private.pem");
+geni=geniID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+jackID=ABAC.ID("Jack_ID.pem");
+jackID.id_load_privkey_file("Jack_private.pem");
+jack=jackID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joeID.id_load_privkey_file("Joe_private.pem");
+joe=joeID.id_keyid()
+
+################################################
+# [keyid:geni].role:leader
+#         <- [keyid:geni].role:equivalent([principal:?P[keyid:geni].role:leader])
+head=ABAC.Role(geni,"leader")
+condoset=ABAC.Role(geni,"leader")
+cond=ABAC.Constraint(condoset)
+param=ABAC.DataTerm("principal","P", cond)
+tail = ABAC.Role(geni,"equivalent")
+tail.role_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_leader__geni_leader_qP_attr.der")
+ctxt.load_attribute_file("geni_leader__geni_leader_qP_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:leader <- [keyid:bob]
+head=ABAC.Role(geni,"leader")
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_leader__Bob_attr.der")
+ctxt.load_attribute_file("geni_leader__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:equivalent([keyid:bob]) <- [keyid:Joe]
+param=ABAC.DataTerm(bobID)
+head = ABAC.Role(geni,"equivalent")
+head.role_add_data_term(param)
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_equivalent_Bob__Joe_attr.der")
+ctxt.load_attribute_file("geni_equivalent_Bob__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:equivalent([keyid:Joe]) <- [keyid:Bob]
+param=ABAC.DataTerm(joeID)
+head = ABAC.Role(geni,"equivalent")
+head.role_add_data_term(param)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_equivalent_Joe__Bob_attr.der")
+ctxt.load_attribute_file("geni_equivalent_Joe__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
+head = ABAC.Role(bob,"niceCoworker")
+tail = ABAC.Role(jack)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Bob_nicecoworker__Maryann_attr.der")
+ctxt.load_attribute_file("Bob_nicecoworker__Maryann_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
+param=ABAC.DataTerm(joeID)
+head = ABAC.Role(geni,"evaluatorOf")
+head.role_add_data_term(param)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_evaluator_j__Bob_attr.der")
+ctxt.load_attribute_file("Alpha_evaluator_j__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
+head = ABAC.Role(bob,"goodPerformance")
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Bob_goodperformance__Joe_attr.der")
+ctxt.load_attribute_file("Bob_goodperformance__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/leader_rt1/leader.save
===================================================================
--- examples/python_tests/leader_rt1/leader.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/leader.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,33 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===good============ geni.leader <- Bob
+YAP query succeed
+pGeni.leader <- pBob
+
+===bad============ geni.leader <- Jack
+YAP query failed
+
+===good============ geni.leader <- Joe
+YAP query succeed
+pGeni.leader <- pGeni.equivalent(P:pGeni.leader)
+pGeni.leader <- pBob
+pGeni.equivalent(pBob) <- pJoe
+
+...final principal set...
+(pBob,keyid,y) 
+(pGeni,keyid,y) 
+(pJack,keyid,y) 
+(pJoe,keyid,y) 
+
+
+
+...final policy attribute set...
+pGeni.evaluatorOf(pJoe) <- pBob
+pBob.goodPerformance <- pJoe
+pBob.niceCoworker <- pJack
+pGeni.equivalent(pBob) <- pJoe
+pGeni.equivalent(pJoe) <- pBob
+pGeni.leader <- pBob
+pGeni.leader <- pGeni.equivalent(P:pGeni.leader)
+
+
Index: examples/python_tests/leader_rt1/query.py
===================================================================
--- examples/python_tests/leader_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,83 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+geniID=ABAC.ID("Geni_ID.pem");
+geniID.id_load_privkey_file("Geni_private.pem");
+geni=geniID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+jackID=ABAC.ID("Jack_ID.pem");
+jackID.id_load_privkey_file("Jack_private.pem");
+jack=jackID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joeID.id_load_privkey_file("Joe_private.pem");
+joe=joeID.id_keyid()
+
+##########################################################################
+# role=[keyid:geni].role:leader 
+# p=[keyid:Bob]
+role = ABAC.Role(geni,"leader")
+p = ABAC.Role(bob)
+print "\n===good============ geni.leader <- Bob"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:geni].role:leader 
+# p=[keyid:Jack]
+role = ABAC.Role(geni,"leader")
+p = ABAC.Role(jack)
+print "\n===bad============ geni.leader <- Jack"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:geni].role:leader 
+# p=[keyid:Joe]
+role = ABAC.Role(geni,"leader")
+p = ABAC.Role(joe)
+print "\n===good============ geni.leader <- Joe"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+
Index: examples/python_tests/leader_rt1/run_test
===================================================================
--- examples/python_tests/leader_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,38 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+
+rm -rf *der *pem
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > leader.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>leader.cn 2>&1
+
+result=`diff leader.cn leader.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:leader_rt1 test result differs!!!"
+    fi
+else
+    echo "   ERROR:leader_rt1 test result differs!!!"
+fi
+
+
Index: examples/python_tests/leader_rt1/setup.py
===================================================================
--- examples/python_tests/leader_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,28 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+geniID=ABAC.ID("Geni", 0)
+geniID.id_write_cert("Geni_ID.pem")
+geniID.id_write_privkey("Geni_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.id_write_cert("Bob_ID.pem")
+bobID.id_write_privkey("Bob_private.pem")
+
+jackID=ABAC.ID("Jack", 0)
+jackID.id_write_cert("Jack_ID.pem")
+jackID.id_write_privkey("Jack_private.pem")
+
+joeID=ABAC.ID("Joe", 0)
+joeID.id_write_cert("Joe_ID.pem")
+joeID.id_write_privkey("Joe_private.pem")
+
Index: examples/python_tests/payraise_rt1/README
===================================================================
--- examples/python_tests/payraise_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/payraise_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,125 @@
+#!/bin/sh
+
+#####################################################################
+# This example demostrates how to use 'this' as a data term of a RT1 
+# policy credential where it is implicitly translated to a variable.
+#
+# Credential 1 is the policy credential with 2 intersecting rules.
+# A employee is up for a pay raise if the evaluator of the employee 
+# affirms his/her good performance and the manager of the employee 
+# affirms his/her pleasantness.
+#
+# Credential 2 is the policy credential that states an evaluator of
+# an employee is also the manager of the employee.
+#
+# Credential 3, 4 and 5 state Bob is the evaluator of Maryann and she
+# is showing good performance and is a nice coworker. Credential 6 and
+# 7 state Bob is also the evaluator of Joe and he is showing good
+# performance. But, there is no fact that says Joe is a nice coworker.
+#
+# The attached ./run_query file asks if a given principal is
+# entitled to a pay raise. Maryann is but not Joe, because his manager
+# did not affirm his pleasantness(but neither did he deny it)
+
+rm -rf *der *pem
+
+# [keyid:Alpha].role:payRaise <-?- [keyid:Maryann] (yes)
+# [keyid:Alpha].role:payRaise <-?- [keyid:Joe] (no)
+
+creddy --generate --cn Alpha
+creddy --generate --cn Bob
+creddy --generate --cn Maryann
+creddy --generate --cn Joe
+
+alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
+
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+performance_qT="evaluatorOf([principal:?this]).goodPerformance"
+niceguy_qT="managerOf([principal:?this]).niceCoworker"
+
+manager_qZ="managerOf([principal:?Z])"
+evaluator_qZ="evaluatorOf([principal:?Z])"
+
+evaluator_m="evaluatorOf([keyid:$maryann_keyid])"
+evaluator_j="evaluatorOf([keyid:$joe_keyid])"
+
+# [keyid:alpha].role:payRaise <-
+#           [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
+#           [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
+# Credential 1
+creddy --attribute \
+       --issuer Alpha_ID.pem --key Alpha_private.pem --role payRaise \
+       --subject-cert Alpha_ID.pem --subject-role "$performance_qT" \
+       --subject-cert Alpha_ID.pem --subject-role "$niceguy_qT" \
+       --out Alpha_payraise__Alpha_performance_qT_niceguy_qT_attr.der
+
+# [keyid:alpha].role:managerOf([principal:?Z])<-
+#           [keyid:alpha].role:evaluatorOf([principal:?Z])
+# Credential 2
+creddy --attribute \
+       --issuer Alpha_ID.pem --key Alpha_private.pem --role "$manager_qZ" \
+       --subject-cert Alpha_ID.pem --subject-role "$evaluator_qZ" \
+       --out Alpha_manager_qZ__Alpha_evaluator_qZ_attr.der
+
+# [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
+# Credential 3
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$evaluator_m" \
+        --subject-cert Bob_ID.pem \
+        --out Alpha_evaluator_m__Bob_attr.der
+
+# [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
+# Credential 4 
+creddy --attribute \
+        --issuer Bob_ID.pem --key Bob_private.pem --role goodPerformance \
+        --subject-cert Maryann_ID.pem \
+        --out Bob_goodperformance__Maryann_attr.der
+
+# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
+# Credential 5 
+creddy --attribute \
+        --issuer Bob_ID.pem --key Bob_private.pem --role niceCoworker \
+        --subject-cert Maryann_ID.pem \
+        --out Bob_niceworker__Maryann_attr.der
+
+# [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
+# Credential 6
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$evaluator_j" \
+        --subject-cert Bob_ID.pem \
+        --out Alpha_evaluator_j__Bob_attr.der
+
+# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
+# Credential 7 
+creddy --attribute \
+        --issuer Bob_ID.pem --key Bob_private.pem --role goodPerformance \
+        --subject-cert Joe_ID.pem \
+        --out Bob_goodperformance__Joe_attr.der
+
+
+#####################################################################
+# 
+# alpha.payRaise <- alpha.evaluatorOf(this).goodPerformance & 
+#                   alpha.managerOf(this).niceCoworker
+# [keyid:alpha].role:payRaise <-
+#           [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
+#           [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
+#
+# alpha.managerOf(this) <- alpha.evaluatorOf(this)
+# [keyid:alpha].role:managerOf([principal:?this])<-
+#           [keyid:alpha].role:evaluatorOf([principal:?this])
+#
+# alpha.evaluatorOf(Maryann)<-Bob
+# [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
+# Bob.goodPerformance<-Maryann
+# [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
+# Bob.niceCoworker<-Maryann
+# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
+#
+# alpha.evaluatorOf(Joe)<-Bob
+# [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
+# Bob.goodPerformance<-Joe
+# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
Index: examples/python_tests/payraise_rt1/attr.py
===================================================================
--- examples/python_tests/payraise_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/payraise_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,159 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+alphaID=ABAC.ID("Alpha_ID.pem");
+alphaID.id_load_privkey_file("Alpha_private.pem");
+alpha=alphaID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem");
+maryannID.id_load_privkey_file("Maryann_private.pem");
+maryann=maryannID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joeID.id_load_privkey_file("Joe_private.pem");
+joe=joeID.id_keyid()
+
+################################################
+# [keyid:alpha].role:payRaise <-
+#      [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
+#      [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
+
+# [keyid:alpha].role:access([string:'Read'],[urn:'file//fileB']) <- [keyid:bob]
+head=ABAC.Role(alpha,"payRaise")
+param=ABAC.DataTerm("principal", "This")
+tail1 = ABAC.Role(alpha,"evaluatorOf","goodPerformance")
+tail1.role_add_linked_data_term(param)
+param=ABAC.DataTerm("principal", "This")
+tail2 = ABAC.Role(alpha,"managerOf","niceCoworker")
+tail2.role_add_linked_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail1)
+attr.attribute_add_tail(tail2)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_payraise__Alpha_performance_qT_niceguy_qT_attr.der")
+ctxt.load_attribute_file("Alpha_payraise__Alpha_performance_qT_niceguy_qT_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:alpha].role:managerOf([principal:?Z])<-
+#           [keyid:alpha].role:evaluatorOf([principal:?Z])
+param=ABAC.DataTerm("principal", "Z")
+head=ABAC.Role(alpha,"managerOf")
+head.role_add_data_term(param)
+param=ABAC.DataTerm("principal", "Z")
+tail = ABAC.Role(alpha,"evaluatorOf")
+tail.role_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_manager_qZ__Alpha_evaluator_qZ_attr.der")
+ctxt.load_attribute_file("Alpha_manager_qZ__Alpha_evaluator_qZ_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
+param=ABAC.DataTerm(maryannID)
+head = ABAC.Role(alpha,"evaluatorOf")
+head.role_add_data_term(param)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_evaluator_m__Bob_attr.der")
+ctxt.load_attribute_file("Alpha_evaluator_m__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
+head = ABAC.Role(bob,"goodPerformance")
+tail = ABAC.Role(maryann)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Bob_goodperformance__Maryann_attr.der")
+ctxt.load_attribute_file("Bob_goodperformance__Maryann_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
+head = ABAC.Role(bob,"niceCoworker")
+tail = ABAC.Role(maryann)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Bob_nicecoworker__Maryann_attr.der")
+ctxt.load_attribute_file("Bob_nicecoworker__Maryann_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
+param=ABAC.DataTerm(joeID)
+head = ABAC.Role(alpha,"evaluatorOf")
+head.role_add_data_term(param)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_evaluator_j__Bob_attr.der")
+ctxt.load_attribute_file("Alpha_evaluator_j__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
+head = ABAC.Role(bob,"goodPerformance")
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Bob_goodperformance__Joe_attr.der")
+ctxt.load_attribute_file("Bob_goodperformance__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/payraise_rt1/pay.save
===================================================================
--- examples/python_tests/payraise_rt1/pay.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/payraise_rt1/pay.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,31 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===bad============ alpha.payRaise <- Joe
+YAP query failed
+
+===good============ alpha.payRaise <- Maryann
+YAP query succeed
+pAlpha.payRaise <- pAlpha.evaluatorOf(This).goodPerformance & pAlpha.managerOf(This).niceCoworker
+pAlpha.evaluatorOf(pJoe) <- pBob
+pBob.goodPerformance <- pMaryann
+pAlpha.managerOf(Z) <- pAlpha.evaluatorOf(Z)
+pBob.niceCoworker <- pMaryann
+
+...final principal set...
+(pAlpha,keyid,y) 
+(pBob,keyid,y) 
+(pJoe,keyid,y) 
+(pMaryann,keyid,y) 
+
+
+
+...final policy attribute set...
+pAlpha.evaluatorOf(pJoe) <- pBob
+pAlpha.evaluatorOf(pMaryann) <- pBob
+pAlpha.managerOf(Z) <- pAlpha.evaluatorOf(Z)
+pAlpha.payRaise <- pAlpha.evaluatorOf(This).goodPerformance & pAlpha.managerOf(This).niceCoworker
+pBob.goodPerformance <- pJoe
+pBob.goodPerformance <- pMaryann
+pBob.niceCoworker <- pMaryann
+
+
Index: examples/python_tests/payraise_rt1/query.py
===================================================================
--- examples/python_tests/payraise_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/payraise_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,75 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+alphaID=ABAC.ID("Alpha_ID.pem");
+alphaID.id_load_privkey_file("Alpha_private.pem");
+alpha=alphaID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+maryannID=ABAC.ID("Maryann_ID.pem");
+maryannID.id_load_privkey_file("Maryann_private.pem");
+maryann=maryannID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joeID.id_load_privkey_file("Joe_private.pem");
+joe=joeID.id_keyid()
+
+##########################################################################
+# role=[keyid:alpha].role:payRaise 
+# p=[keyid:Joe]
+role = ABAC.Role(alpha,"payRaise")
+p = ABAC.Role(joe)
+print "\n===bad============ alpha.payRaise <- Joe"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+
+##########################################################################
+# role=[keyid:alpha].role:payRaise 
+# p=[keyid:Maryann]
+role = ABAC.Role(alpha,"payRaise")
+p = ABAC.Role(maryann)
+print "\n===good============ alpha.payRaise <- Maryann"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+
Index: examples/python_tests/payraise_rt1/run_test
===================================================================
--- examples/python_tests/payraise_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/payraise_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,38 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+
+rm -rf *der *pem
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > pay.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>pay.cn 2>&1
+
+result=`diff pay.cn pay.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:payraise_rt1 test result differs!!!"
+    fi
+else
+    echo "   ERROR:payraise_rt1 test result differs!!!"
+fi
+
+
Index: examples/python_tests/payraise_rt1/setup.py
===================================================================
--- examples/python_tests/payraise_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/payraise_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,28 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+alphaID=ABAC.ID("Alpha", 0)
+alphaID.id_write_cert("Alpha_ID.pem")
+alphaID.id_write_privkey("Alpha_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.id_write_cert("Bob_ID.pem")
+bobID.id_write_privkey("Bob_private.pem")
+
+maryannID=ABAC.ID("Maryann", 0)
+maryannID.id_write_cert("Maryann_ID.pem")
+maryannID.id_write_privkey("Maryann_private.pem")
+
+joeID=ABAC.ID("Joe", 0)
+joeID.id_write_cert("Joe_ID.pem")
+joeID.id_write_privkey("Joe_private.pem")
+
