Index: java/net/deterlab/abac/ABACException.java
===================================================================
--- java/net/deterlab/abac/ABACException.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/ABACException.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -2,6 +2,7 @@
 
 /**
- * Superclass for all jabac Exceptions passed to the user.  All these
- * exceptions include a cause from the underlying library that caused them when
+ * Superclass for all jabac Exceptions passed to the user; some generic errors
+ * also throw ABACExceptions.  These exceptions include a cause from the
+ * underlying library that caused them when
  * possible.
  * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
Index: java/net/deterlab/abac/BadSignatureException.java
===================================================================
--- java/net/deterlab/abac/BadSignatureException.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/BadSignatureException.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -2,5 +2,5 @@
 
 /**
- * A Bad Signature was found on an ID or Credential.  All these exceptions
+ * A Bad Signature was found on an ID or Credential.  These exceptions
  * include a cause from the underlying library that caused them when possible.
  * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
Index: java/net/deterlab/abac/CertInvalidException.java
===================================================================
--- java/net/deterlab/abac/CertInvalidException.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/CertInvalidException.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -4,5 +4,5 @@
  * A Certificate (ID or Credential) was invalid for a reason other than bad
  * signature or missing issuer, usually something that is not a certificate at
- * all was parsed.  All these exceptions include a cause from the underlying
+ * all was parsed.  These exceptions include a cause from the underlying
  * library that caused them when possible.
  * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
Index: java/net/deterlab/abac/Credential.java
===================================================================
--- java/net/deterlab/abac/Credential.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/Credential.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -34,5 +34,5 @@
      * Create an empty Credential.
      */
-    public Credential() {
+    Credential() {
 	m_head = m_tail = null;
 	id = null;
@@ -46,5 +46,5 @@
      * @param tail the Role at the tail of the credential
      */
-    public Credential(Role head, Role tail) {
+    Credential(Role head, Role tail) {
         m_head = head;
         m_tail = tail;
@@ -117,5 +117,6 @@
 
     /**
-     * Two credentials are the same if their roles are the same.
+     * Return true if 2 credentials represent the same ABAC. Two credentials
+     * are the same if their roles are the same.
      * @param o an Object to compare
      * @return true if the Credentials have the Roles 
@@ -132,6 +133,6 @@
 
     /**
-     * Allow credentials to be compared.  They are ordered by their Roles, head
-     * then tail.
+     * Compare 2 credentials for sorting.  They are ordered by their Roles,
+     * head then tail.
      * @param o an Object to compare
      * @return -1 if this Credential is before, 0 if they are the same, and 1
@@ -162,6 +163,7 @@
 
     /**
-     * Turn the credential into string form. The format is head &lt;- tail. For
-     * example: A.r1 &lt;- B.r2.r3.  Principal names are key identifiers.
+     * Return an untranslated string form of the credential. The format is head
+     * &lt;- tail. For example: A.r1 &lt;- B.r2.r3.  Principal names are key
+     * identifiers.
      * @return the string form
      */
@@ -171,7 +173,7 @@
 
     /**
-     * Turn the credential into string form. The format is head &lt;- tail. For
-     * example: A.r1 &lt;- B.r2.r3.  Principal names are shortened to menmonics
-     * if the Context knows the identity.
+     * Return a translated string form of the credential. The format is head
+     * &lt;- tail. For example: A.r1 &lt;- B.r2.r3.  Principal names are
+     * shortened to menmonics if the Context knows the identity.
      * @param c the Context to translate names in
      * @return the string form
@@ -182,6 +184,6 @@
 
     /**
-     * Output the DER formatted attribute certificate associated with this
-     * Credential to the OutputStream.
+     * Output the external representation of the Credential to the OutputStream
+     * given. Subclasses will overload this for their output format.
      * @param s the OutputStream on which to write
      * @throws IOException if there is an error writing.
@@ -190,6 +192,6 @@
 
     /**
-     * Output the DER formatted attribute certificate associated with this
-     * Credential to the filename given.
+     * Output the external representation of the Credential to the filename
+     * given. Subclasses will overload this for their output format.
      * @param fn a String containing the output filename
      * @throws IOException if there is an error writing.
@@ -206,14 +208,9 @@
 
     /**
-     * Return the Identity that issued the underlying certificate.  A jabac
-     * extension.
-     * @return the Identity that issued the underlying certificate.
+     * Return the Identity that issued the underlying certificate (if any).  A
+     * jabac extension.
+     * @return the Identity that issued the underlying certificate. 
      */
     public Identity issuer() { return id; }
-    /**
-     * Return the X509Certificate that issued the underlying certificate.
-     * @return the X509Certificate that issued the underlying certificate.
-     */
-    public X509Certificate issuerCert() { return id.getCertificate(); }
 
 }
Index: java/net/deterlab/abac/CredentialFactory.java
===================================================================
--- java/net/deterlab/abac/CredentialFactory.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/CredentialFactory.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -7,8 +7,7 @@
 
 /**
- * The system demultiplex point for parsing Credentials.  Static class that
- * keeps an ordered list of CredentialParsers to try and a couple helper
- * functions to open files, etc in calling the CredentialParsers.  All
- * credential parsing should use a credential factory.
+ * A class for parsing and generating Credentials inside a Context.  All
+ * credential parsing should use a credential factory inside a context uses a
+ * CredentialFactory.
  * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
  * @version 1.4
@@ -16,8 +15,10 @@
 public class CredentialFactory implements Cloneable {
     protected List<CredentialFactorySpecialization> spec;
+    /** The classes understood by the default CredentialFactory (in order) */
     static public String[] defNames = new String[] {
 	"net.deterlab.abac.GENICredential",
 	"net.deterlab.abac.X509Credential"
     };
+    /** Maximum credential size that can be rewound for reparsing */
     public static final int maxSize = 50 * 1024;
 
@@ -77,5 +78,5 @@
     /**
      * Make a copy of this CredentialFactory
-     * @returns a CredentialFactory, a copy of this one
+     * @return a CredentialFactory, a copy of this one
      */
     public Object clone() throws CloneNotSupportedException {
@@ -178,6 +179,6 @@
 
     /**
-     * Return a credential of the from the first
-     * CredentialFactorySpecialization in the factory.
+     * Return a credential from the first class registered in
+     * the factory.
      * @param head a Role, the head of the encoded ABAC statement
      * @param tail a Role, the tail of the decoded ABAC statement
Index: java/net/deterlab/abac/CredentialFactorySpecialization.java
===================================================================
--- java/net/deterlab/abac/CredentialFactorySpecialization.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/CredentialFactorySpecialization.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -8,5 +8,5 @@
 /**
  * This class parses or generates credentials.  The parser produces one or more
- * Credentials.  the generator produces exactly one credential. Each class that
+ * Credentials.  The generator produces exactly one credential. Each class that
  * wants to be parsed and generated needs to export a static method that
  * returns one of these.  For credentials that parse 1 credential to 1 input it
Index: java/net/deterlab/abac/GENICredential.java
===================================================================
--- java/net/deterlab/abac/GENICredential.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/GENICredential.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -32,7 +32,5 @@
 
 /**
- * An ABAC credential, with or without an underlying certificate that
- * represents it.  These are edges in proof garphs and can be constructed from
- * their constituent Roles.
+ * An ABAC credential formatted as an abac-type GENI credential.
  * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
  * @version 1.4
Index: java/net/deterlab/abac/Identity.java
===================================================================
--- java/net/deterlab/abac/Identity.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/Identity.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -138,5 +138,5 @@
 
     /**
-     * Construct from a file, containing a self-signed PEM certificate.
+     * Construct from a file containing a self-signed PEM certificate.
      * @param file the File to read
      * @throws CertificateException if the certificate is badly formatted
@@ -359,5 +359,6 @@
 
     /**
-     * Equality test.  Two Identities are equal if their key ID's match.
+     * Return true if the two identites refer to teh same key.  Two Identities
+     * are equal if their key ID's match.
      * @return true if the two key ID's are equal.
      */
@@ -368,5 +369,5 @@
     }
     /**
-     * Allow Identities to be compared.  They are ordered by their key ID's.
+     * Order 2 identities for sorting.  They are ordered by their key ID's.
      * @param o an Object to compare
      * @return -1 if this Identity is before, 0 if they are the same, and 1
Index: java/net/deterlab/abac/InternalCredential.java
===================================================================
--- java/net/deterlab/abac/InternalCredential.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/InternalCredential.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -18,5 +18,6 @@
 /**
  * An Internal Credential, used to represent extra arcs in the proof graph.  It
- * should never be converted to a cert or output.
+ * should never be converted to a cert or output.  They are useful outside as
+ * placeholder credentials outside the main jabac library.
  * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
  * @version 1.4
@@ -37,53 +38,8 @@
 
     /**
-     * Create a credential from an attribute cert in a file.  This will always
-     * fail for in InternalCredential.
-     * @param filename a String containing the filename to read
-     * @param ids a Collection of Identities to use in validating the cert
-     * @throws CertInvalidException if the stream is unparsable
-     * @throws MissingIssuerException if none of the Identities can validate the
-     *				    certificate
-     * @throws BadSignatureException if the signature check fails
-     */
-    public InternalCredential(String filename, Collection<Identity> ids) 
-	throws ABACException { this(); }
-
-    /**
-     * Create a credential from an attribute cert in a file.   This will always
-     * * fail for in InternalCredential.
-     * @param file the File to read
-     * @param ids a Collection of Identities to use in validating the cert
-     * @throws CertInvalidException if the stream is unparsable
-     * @throws MissingIssuerException if none of the Identities can validate the
-     *				    certificate
-     * @throws BadSignatureException if the signature check fails
-     */
-    public InternalCredential(File file, Collection<Identity> ids) 
-	    throws ABACException {
-	 this();
-    }
-
-    /**
-     * Create a credential from an InputStream.  This will always
-     * fail for in InternalCredential.
-     * @param ids a Collection of Identities to use in validating the cert
-     * @throws CertInvalidException if the stream is unparsable
-     * @throws MissingIssuerException if none of the Identities can validate the
-     *				    certificate
-     * @throws BadSignatureException if the signature check fails
-     */
-    public InternalCredential(InputStream s, Collection<Identity> ids) 
-	    throws ABACException {
-	 this();
-    }
-
-
-    /**
-     * Create a certificate from this credential issued by the given identity.
-     * This will always fail for an InternalCredential.
+     * Create a certificate from this credential issued by the given identity;
+     * this will always fail for an InternalCredential.
      * @param i the Identity that will issue the certificate
-     * @throws ABACException for Credential-specific errors
-     * @throws MissingIssuerException the identity is invalid
-     * @throws BadSignatureException if the signature creation fails
+     * @throws ABACException whenever called.
      */
     public void make_cert(Identity i) throws ABACException {
@@ -93,9 +49,7 @@
 
     /**
-     * Output the DER formatted attribute certificate associated with this
-     * Credential to the OutputStream.  This will always fail for an
-     * InternalCredential.
+     * This will always fail for an InternalCredential.
      * @param s the OutputStream on which to write
-     * @throws IOException if there is an error writing.
+     * @throws IOException whenever called.
      */
     public void write(OutputStream s) throws IOException {
@@ -105,9 +59,7 @@
 
     /**
-     * Output the DER formatted attribute certificate associated with this
-     * Credential to the filename given.  This will always fail for an
-     * InternalCredential.
+     * This will always fail for an  InternalCredential.
      * @param fn a String containing the output filename
-     * @throws IOException if there is an error writing.
+     * @throws IOException whenever called.
      */
     public void write(String fn) 
@@ -117,7 +69,7 @@
 
     /**
-     * Return true if this Credential has a certificate associated.  A jabac
-     * extension.  Always false for an InternalCredential.
-     * @return true if this Credential has a certificate associated.
+     * Return true if this Credential has a certificate associated; it never
+     * will.
+     * @return false
      */
     public boolean hasCertificate() { return false; }
Index: java/net/deterlab/abac/Role.java
===================================================================
--- java/net/deterlab/abac/Role.java	(revision e8f8b79183b79a52c1228cbce69bb98a6d9d3d03)
+++ java/net/deterlab/abac/Role.java	(revision a7f73b507318d4b0254959cebf55a1085bf99401)
@@ -192,5 +192,5 @@
      * @throws RuntimeException if this is not an intersection role
      */
-    public Role[] prereqs() throws RuntimeException {
+    Role[] prereqs() throws RuntimeException {
         if (!is_intersection())
             throw new RuntimeException("Not an intersection role.");
@@ -219,6 +219,6 @@
 
     /**
-     * Equality test.  Two Roles are the same if their string representations
-     * are equal.
+     * Return true if the two roles are the same.  Two Roles are the same if
+     * their string representations are equal.
      * @param v2 an Object to compare
      * @return a boolean, true if the two Roles are equal.
@@ -231,5 +231,6 @@
 
     /**
-     * Partial order test.  Return a lexical comparison of the two Roles
+     * Order the roles for sorting.  Return a lexical comparison of the two
+     * Roles
      * @param o an Object to compare against
      * @return -1 if this Role is before, 0 if they are the same, and 1
