Index: examples/creddy_prover_tests/access_rt2/README
===================================================================
--- examples/creddy_prover_tests/access_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/access_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -27,5 +27,5 @@
 # proj2.
 
-# access_rt2_typed
+# access_rt2
 
 # alpha.access(Read,fileA)<-?-bob  good
Index: examples/creddy_prover_tests/access_rt2/run_query
===================================================================
--- examples/creddy_prover_tests/access_rt2/run_query	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/access_rt2/run_query	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -11,4 +11,6 @@
 bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
 joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+
+print $eloc/abac_prover_yap
 
 bob_prin="[keyid:$bob]"
Index: examples/creddy_prover_tests/acme_friend_rt1/README
===================================================================
--- examples/creddy_prover_tests/acme_friend_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/acme_friend_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -22,5 +22,5 @@
 # does).
 
-# acme_friend_rt1_typed
+# acme_friend_rt1
 
 #[keyid:Acme].role:friendof([keyid:Roadrunner]) <-?- [keyid:Coyote] (no)
Index: examples/creddy_prover_tests/acme_rockets_intersection_rt0/README
===================================================================
--- examples/creddy_prover_tests/acme_rockets_intersection_rt0/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/acme_rockets_intersection_rt0/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -35,5 +35,5 @@
 #
 
-# acme_rockets_intersection_rt0_typed
+# acme_rockets_intersection_rt0
 
 creddy --generate --cn Acme
Index: examples/creddy_prover_tests/acme_rockets_rt0/README
===================================================================
--- examples/creddy_prover_tests/acme_rockets_rt0/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/acme_rockets_rt0/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -14,5 +14,5 @@
 # something other than a principal works (it doesn't).
 
-# acme_rockets_rt0_typed
+# acme_rockets_rt0
 
 creddy --generate --cn Acme
Index: examples/creddy_prover_tests/alice_rt1/README
===================================================================
--- examples/creddy_prover_tests/alice_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/alice_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -3,5 +3,5 @@
 ## trying out different data param types
 
-# alice_rt1_typed
+# alice_rt1
 
 creddy --generate --cn Alice
Index: examples/creddy_prover_tests/alumni2_rt1/README
===================================================================
--- examples/creddy_prover_tests/alumni2_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/alumni2_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -17,5 +17,5 @@
 # alums, and only Bob is.
 
-# alumni2_rt1_typeD
+# alumni2_rt1
 
 # [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
Index: examples/creddy_prover_tests/alumni3_rt1/README
===================================================================
--- examples/creddy_prover_tests/alumni3_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/alumni3_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -16,5 +16,5 @@
 # alums, and only Bob and Jan are.
 
-# alumni3_rt1_typed
+# alumni3_rt1
 
 rm -rf *.der *.pem
Index: examples/creddy_prover_tests/alumni_rt1/README
===================================================================
--- examples/creddy_prover_tests/alumni_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/alumni_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -16,5 +16,5 @@
 # alums and Joe and Maryann are.
 
-# alumni_rt1_typed
+# alumni_rt1
 
 # [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (no)
Index: examples/creddy_prover_tests/balltime_rt2/README
===================================================================
--- examples/creddy_prover_tests/balltime_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/balltime_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -30,5 +30,5 @@
 # stadium's free-for-all early morning time
 
-# balltime_rt2_typed
+# balltime_rt2
 
 creddy --generate --cn League
Index: examples/creddy_prover_tests/evaluator_rt1/README
===================================================================
--- examples/creddy_prover_tests/evaluator_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/evaluator_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -16,5 +16,5 @@
 # ISI employee.
 
-# evaluator_rt1_typed
+# evaluator_rt1
 
 #[keyid:USC].role:employee <-?- [keyid:John]
Index: examples/creddy_prover_tests/experiment_create_rt0/README
===================================================================
--- examples/creddy_prover_tests/experiment_create_rt0/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/experiment_create_rt0/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -25,5 +25,5 @@
 #
 
-# experiment_create_rt0_typed 
+# experiment_create_rt0 
 
 creddy --generate --cn Acme
Index: examples/creddy_prover_tests/file_read_rt2/README
===================================================================
--- examples/creddy_prover_tests/file_read_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/file_read_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -21,5 +21,5 @@
 # fileA, then it confirms that Maryann cannot. 
 
-# file_read_rt2_typed
+# file_read_rt2
 
 # alpha.read(fileA) <-?- Bob
Index: examples/creddy_prover_tests/fruits_rt2/README
===================================================================
--- examples/creddy_prover_tests/fruits_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/fruits_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -23,5 +23,5 @@
 # 1.50 (we don't know anything about green apples).
 
-# fruits_rt2_typed
+# fruits_rt2
 
 # mary.what2eat<-?-navel orange  good
Index: examples/creddy_prover_tests/leader_rt1/README
===================================================================
--- examples/creddy_prover_tests/leader_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/leader_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -18,5 +18,5 @@
 # rule from Bob to him.
 
-# leader_rt1_typed
+# leader_rt1
 
 # [keyid:geni].role:leader <-?- [keyid:Bob] (yes)
Index: examples/creddy_prover_tests/payraise_rt1/README
===================================================================
--- examples/creddy_prover_tests/payraise_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/payraise_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -22,5 +22,5 @@
 # did not affirm his pleasantness(but neither did he deny it)
 
-rm -rf *der *pem
+# payraise_rt1
 
 # [keyid:Alpha].role:payRaise <-?- [keyid:Maryann] (yes)
Index: examples/creddy_prover_tests/runall
===================================================================
--- examples/creddy_prover_tests/runall	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/runall	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -14,5 +14,11 @@
 fi
 
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+
+UID=`id | sed -e 's/ .*//' | sed -e 's/.*(//' | sed -e 's/)//'`
+if [ $UID = "mei" ]; then
+    ABAC_PROVER_PATH="../../../libabac"
+    else
+    ABAC_PROVER_PATH=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+fi
 export ABAC_PROVER_PATH
 
Index: examples/creddy_prover_tests/runcheck
===================================================================
--- examples/creddy_prover_tests/runcheck	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/creddy_prover_tests/runcheck	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -3,5 +3,10 @@
 rm -rf allout.cn allout.sha
 
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+UID=`id | sed -e 's/ .*//' | sed -e 's/.*(//' | sed -e 's/)//'`
+if [ $UID = "mei" ]; then
+    ABAC_PROVER_PATH="../../../libabac"
+    else
+    ABAC_PROVER_PATH=`which abac_prover_yap | sed 's/\/abac_prover_yap//'`
+fi
 export ABAC_PROVER_PATH
 
Index: examples/python_tests/access_rt2/README
===================================================================
--- examples/python_tests/access_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/access_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,3 @@
 #####################################################################
-# access_rt2
 # This example demonstrates using an oset (object set) to control access
 # to files based on the attributes of the principals.  The script creates
@@ -8,9 +7,9 @@
 # 
 # A principal's access rights are controlled by the Alpha principal.  If a 
-# principal has the role role::aceess(string:'Read', urn:filename) that 
+# principal has the role role::acess(string:'Read', urn:filename) that 
 # principal can Read filename.  
 # The policy names 2 teams, proj1 and proj1.  A principal is on proj1 if it
 # has the role team(string:'proj1') defined by Alpha (written
-# [keyid:Alpha}.role:team(string:'proj1')).  Each project has an associated set
+# [keyid:Alpha].role:team(string:'proj1')).  Each project has an associated set
 # of files, defined by object sets.  A file is in proj1's documents if it is in
 # the oset of documents('proj1') defined by Alpha, written
@@ -25,4 +24,7 @@
 # fileA, then it confirms that Joe cannot.  Finally it confirms that Joe is in
 # proj2.
+
+# access_rt2
+
 # Credential 1
 #[keyid:alpha].role:access([string:'Read'],
@@ -35,7 +37,2 @@
 # Credential 4
 # [keyid:alpha].role:team([string:'proj2'])<-[keyid:Joe]
-creddy --attribute \
-        --issuer Alpha_ID.pem --key Alpha_private.pem \
-        --role "team([string:'proj2'])" \
-        --subject-cert Joe_ID.pem \
-        --out Alpha_team_proj2__Joe_attr.der
Index: examples/python_tests/access_rt2/access.save
===================================================================
--- examples/python_tests/access_rt2/access.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/access_rt2/access.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,15 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAlpha,keyid,y) 
+(pBob,keyid,y) 
+(pJoe,keyid,y) 
+
+...final policy attribute set...
+pAlpha.access('Read','file//fileB') <- pBob
+pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
+pAlpha.team('proj1') <- pBob
+pAlpha.documents('proj1') <- 'file//fileA'
+pAlpha.team('proj2') <- pJoe
 
 ===good============ Alpha.access(Read,fileA)<-?-Bob
@@ -13,18 +25,2 @@
 YAP query succeed
 pAlpha.team('proj2') <- pJoe
-
-...final principal set...
-(pAlpha,keyid,y) 
-(pBob,keyid,y) 
-(pJoe,keyid,y) 
-
-
-
-...final policy attribute set...
-pAlpha.access('Read','file//fileB') <- pBob
-pAlpha.access('Read',F:pAlpha.documents(P)) <- pAlpha.team(P)
-pAlpha.team('proj1') <- pBob
-pAlpha.documents('proj1') <- 'file//fileA'
-pAlpha.team('proj2') <- pJoe
-
-
Index: examples/python_tests/access_rt2/attr.py
===================================================================
--- examples/python_tests/access_rt2/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/access_rt2/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,23 +2,22 @@
 
 """
-  to test with python
+See README in this directory for the semantics of the example.  This file
+creates a principal(Joe) and constructs the credentials described and puts 
+copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
 """
 
-# See README in this directory for the semantics of the example.  This file
-# constructs the credentials described and puts copies into this directory
-
 import os
 import ABAC
-
-# Keystore is the directory containing the principal credentials.
-keystore=os.environ["keystore"]
 
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-# Load existing principals
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 # Print the principals and credentials in the keystore
@@ -42,8 +41,8 @@
 joeID.id_write_privkey("Joe_private.pem")
 joeID.id_write_cert("Joe_ID.pem")
-# Keep a copy if Joe's key identifier as a string.
+# Keep a copy of Joe's key identifier as a string.
 joe=joeID.id_keyid()
 
-# Load alpha and bob from local files (created by ./setup.py
+# Load alpha and bob from local files (created by ./setup.py)
 alphaID=ABAC.ID("Alpha_ID.pem")
 alphaID.id_load_privkey_file("Alpha_private.pem");
@@ -133,7 +132,7 @@
 attr.attribute_write_cert("Alpha_access_qFqP__alpha_team_qP_attr.der")
 ctxt.load_attribute(attr)
-#print attr.string() 
-#print attr.typed_string()
-#print "\n"
+print attr.string() 
+print attr.typed_string()
+print "\n"
 
 
@@ -154,4 +153,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/access_rt2/query.py
===================================================================
--- examples/python_tests/access_rt2/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/access_rt2/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -12,14 +12,14 @@
 import ABAC
 
-# Run the queries described in README
-
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
-
-# If a keystore is given in the environment, pre-load those credentials
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1) 
 
 # Load the principals created in ./attr.py and ./setup.py.  Each has an
@@ -27,10 +27,8 @@
 alphaID=ABAC.ID("Alpha_ID.pem");
 alphaID.id_load_privkey_file("Alpha_private.pem");
-#ctxt.load_id(alphaID)
 alpha=alphaID.id_keyid()
 
 bobID=ABAC.ID("Bob_ID.pem");
 bobID.id_load_privkey_file("Bob_private.pem");
-#ctxt.load_id(bobID)
 bob=bobID.id_keyid()
 
@@ -39,4 +37,17 @@
 joe=joeID.id_keyid()
 
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
 # Construct and run the queries.  In each case we create a role object and a
 # principal and call the query method on the context.  The contents of the
@@ -90,17 +101,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-##########################################################################
-# dump the loaded principals/policies 
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
Index: examples/python_tests/access_rt2/run_test
===================================================================
--- examples/python_tests/access_rt2/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/access_rt2/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,7 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
-
 
 echo '---setup principals'
Index: examples/python_tests/access_rt2/setup.py
===================================================================
--- examples/python_tests/access_rt2/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/access_rt2/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,13 +2,10 @@
 
 """
-  to test with python
-
+See README for the semantics.  This creates two of three prinicpals 
+(Alpha and Bob) used by the example. 
 
 """
 import os
 import ABAC
-
-# See README for the semantics.  This creates two prinicpals (Alpha and Bob)
-# used by the example.  The ./attrs.py file creates the policy credentials.
 
 ctxt = ABAC.Context()
Index: examples/python_tests/acme_friend_rt1/README
===================================================================
--- examples/python_tests/acme_friend_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_friend_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 # This example shows how a parameterized role can be used to infer a role and
 # that the same role can also be directly assigned.  The example has 4
-# principals, the Acme company, a Coyote, a RoadRUnner and a Jackrabbit.
+# principals, the Acme company, a Coyote, a RoadRunner and a Jackrabbit.
 #
 # The policy of the Acme company is that anyone the Acme company thinks is a
@@ -9,33 +9,27 @@
 # customer has the [keyid:Acme].role:preferred_customer role.
 #
-# This script creates the 4 and 3 credentials.  Credential 1 lays out the rule
+# setup.py script creates the 4 principal: Acme, Coyote, Roadrunner and 
+# Jackrabbit.
+# attr.py script creates 3 policy credentials,  Credential 1 lays out the rule
 # that friends of the Roadrunner are preferred customers.  Credential 2
 # directly makes the Coyote a preferred customer.  Credential 3 recognizes that
 # Acme thinks that the Jackrabbit is the Roadrunner's friend.
 # 
-# The attached ./run_query script tests whether the coyote is a friend of the
-# Roadrunner (which fails), whether the Jackrabbit is a friend of teh
+# The query.py script tests whether the coyote is a friend of the
+# Roadrunner (which fails), whether the Jackrabbit is a friend of the
 # Roadrunner (which succeeds), whether the Jackrabbit is a preferred customer
 # (which succeeds), whether the Coyote is a prefered customer (succeeds for a
 # different reason) and whether the system fails to load a bad certificate (it
 # does).
-
+#
 # acme_friend_rt1
-
-#[keyid:Acme].role:friendof([keyid:Roadrunner]) <-?- [keyid:Coyote] (no)
-#[keyid:Acme].role:preferred_customer <-?- [keyid:Jackrabbit] (yes)
-
-creddy --generate --cn Acme
-creddy --generate --cn Coyote
-creddy --generate --cn Roadrunner
-creddy --generate --cn Jackrabbit
-
-roadrunner_keyid=`creddy --keyid --cert Roadrunner_ID.pem`
-friendof_roadrunner="friendOf([keyid:$roadrunner_keyid])"
-
+#
+# Credential 1
 #[keyid:Acme].role:preferred_customer <- [keyid:Acme].role:friendOf([keyid:Roadrunner])
 
+# Credential 2
 #[keyid:Acme].role:prefered_customer <- [keyid:Coyote]
 
+# Credential 3
 #[keyid:Acme].role:friendOf([keyid:Roadrunner]) <- [keyid:Jackrabbit]
 
Index: examples/python_tests/acme_friend_rt1/attr.py
===================================================================
--- examples/python_tests/acme_friend_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_friend_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,8 +2,8 @@
 
 """
-  Setup access policy attribute rules
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
-
 """
 
@@ -11,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -30,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 acmeID=ABAC.ID("Acme_ID.pem")
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -47,14 +50,25 @@
 
 ################################################
+# Credential 1 
 # [keyid:Acme].role:preferred_customer <- [keyid:Acme].role:friendof([keyid:Roadrunner])
 head = ABAC.Role(acme,"preferred_customer")
 param=ABAC.DataTerm(roadrunnerID)
 tail = ABAC.Role(acme,"friendof")
+
+# adding parameter to friendOf role
 tail.role_add_data_term(param)
+
+# link the head and tail parts of attribute together
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the attribute
 attr.attribute_bake()
+
+# write to file system to be accessible later on
 attr.attribute_write_cert("Acme_preferred_customer__Acme_friendof_Roadrunner_attr.der")
-#ctxt.load_attribute_file("Acme_preferred_customer__Acme_friendof_Roadrunner_attr.der")
+
+# load the credential just made into the context directly
+# (bypass the external credential file)
 ctxt.load_attribute(attr)
 print attr.string() 
@@ -63,4 +77,5 @@
 
 #################################################
+# Credential 2
 # [keyid:Acme].role:prefered_customer <- [keyid:Coyote]
 head = ABAC.Role(acme,"preferred_customer")
@@ -70,5 +85,4 @@
 attr.attribute_bake()
 attr.attribute_write_cert("Acme_preferred_customer__Coyote_attr.der")
-#ctxt.load_attribute_file("Acme_preferred_customer__Coyote_attr.der")
 ctxt.load_attribute(attr)
 print attr.string() 
@@ -77,4 +91,5 @@
 
 #################################################
+# Credential 3
 # [keyid:Acme].role:friendof([keyid:Roadrunner]) <- [keyid:Jackrabbit]
 param=ABAC.DataTerm(roadrunnerID)
@@ -86,5 +101,4 @@
 attr.attribute_bake()
 attr.attribute_write_cert("Acme_friendof_Roadrunner__Jackrabbit_attr.der")
-#ctxt.load_attribute_file("Acme_friendof_Roadrunner__Jackrabbit_attr.der")
 ctxt.load_attribute(attr)
 print attr.string() 
@@ -92,4 +106,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/acme_friend_rt1/friend.save
===================================================================
--- examples/python_tests/acme_friend_rt1/friend.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_friend_rt1/friend.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,14 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAcme,keyid,y) 
+(pCoyote,keyid,y) 
+(pJackrabbit,keyid,y) 
+(pRoadrunner,keyid,y) 
+
+...final policy attribute set...
+pAcme.friendof(pRoadrunner) <- pJackrabbit
+pAcme.preferred_customer <- pAcme.friendof(pRoadrunner)
+pAcme.preferred_customer <- pCoyote
 
 ===bad============ Acme.friendOf(Roadrunner) <- Coyote
@@ -17,16 +28,4 @@
 pAcme.preferred_customer <- pCoyote
 
-...final principal set...
-(pAcme,keyid,y) 
-(pCoyote,keyid,y) 
-(pJackrabbit,keyid,y) 
-(pRoadrunner,keyid,y) 
-
-
-
-...final policy attribute set...
-pAcme.friendof(pRoadrunner) <- pJackrabbit
-pAcme.preferred_customer <- pAcme.friendof(pRoadrunner)
-pAcme.preferred_customer <- pCoyote
-
-
+===bad============ Acme.preferred_customer <- badcoyote
+fail, query's call got bad aspect names .. 
Index: examples/python_tests/acme_friend_rt1/query.py
===================================================================
--- examples/python_tests/acme_friend_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_friend_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,9 +2,8 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
 cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
-
 """
 
@@ -14,10 +13,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# extract principal's keyid from local principal cert files
 acmeID=ABAC.ID("Acme_ID.pem")
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -37,4 +40,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is coyote a friend of roadrunner?
 # role =[keyid:Acme].role:friendof([keyid:Roadrunner]) 
 # p= [keyid:Coyote]
@@ -50,4 +66,5 @@
 
 ##########################################################################
+# is jackrabbit a friend of roadrunner ?
 # role =[keyid:Acme].role:friendof([keyid:Roadrunner]) 
 # p= [keyid:Jackrabbit]
@@ -64,4 +81,5 @@
 
 ##########################################################################
+# is jackrabbit a preferred_customer of Acme ?
 # role =[keyid:Acme].role:preferred_customer
 # p =[keyid:Jackrabbit]
@@ -75,4 +93,5 @@
 
 ##########################################################################
+# is coyote a preferred_customer of Acme ?
 # role =[keyid:Acme].role:preferred_customer
 # p =[keyid:Coyote]
@@ -86,16 +105,16 @@
 
 
+##########################################################################
+# is blah_blah a preferred_customer of Acme ?
+# role =[keyid:Acme].role:preferred_customer
+# p =[keyid:badCoyote]
+role = ABAC.Role(acme,"preferred_customer")
+# some random SHA keyid value
+badcoyote="1fb66793d453226f0b93a48c7f6ae0d51632e628"
+p = ABAC.Role(badcoyote)
+print "\n===bad============ Acme.preferred_customer <- badcoyote"
+out = ctxt.query(role, p)
 
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
+
Index: examples/python_tests/acme_friend_rt1/run_test
===================================================================
--- examples/python_tests/acme_friend_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_friend_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/acme_friend_rt1/setup.py
===================================================================
--- examples/python_tests/acme_friend_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_friend_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  Setup 4 principal ID credentials
-
-  Acme, Coyote, Roadrunner and Jackrabbit
+See README for the semantics.  This creates 4 prinicpals (Acme, Coyote,
+Roadrunner and Jackrabbit) used by the example.  
 
 """
Index: examples/python_tests/acme_rockets_intersection_rt0/README
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_intersection_rt0/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,4 @@
 #
-# This example demonstrates intersections.  An intersection is a logical and of
+# This example demonstrates intersections.  An intersection is a logical-AND of
 # roles or osets.  An intersection succeeds if the principal is in the
 # intersection of the sets defined by the roles.
@@ -25,6 +25,15 @@
 #    Acme.buy_rockets <-?- Batman
 # 
-# Acme.buy_rockets <- Acme.preferred_customer & WarnerBros.character
-# Acme.preferred_customer <- Coyote
-# Acme.preferred_customer <- Batman
-# WarnerBros.character <- Coyote
+# acme_rockets_intersection_rt0
+
+# Credential 1
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+                                    & [keyid:WarnerBros].role:charater
+# Credential 2
+# [keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+
+# Credential 3
+#[keyid:Acme].role:preferred_customer <- [keyid:Batman]
+
+# Credential 4
+#[keyid:WarnerBros].role:character <- [keyid:Coyote]
Index: examples/python_tests/acme_rockets_intersection_rt0/attr.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,17 +2,22 @@
 
 """
-  Setup access policy attribute rules
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
-
 """
 import os
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+
+# retrieve principals' keyid value from local credential files
 acmeID=ABAC.ID("Acme_ID.pem");
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -37,4 +42,6 @@
 
 ################################################
+# Credential 1, establish the intersection rule on who can buy
+# rockets from Acme
 #[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
 #                                    & [keyid:WarnerBros].role:charater
@@ -43,8 +50,17 @@
 tail2 = ABAC.Role(warnerbros,"character")
 attr=ABAC.Attribute(head, 1800)
+
+# to add intersection, just add multiple tails, make sure they are all
+# roles or all osets
 attr.attribute_add_tail(tail1)
 attr.attribute_add_tail(tail2)
+
+# finalize the rule
 attr.attribute_bake()
+
+# save it out as external credential file
 attr.attribute_write_cert("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.der")
+
+# load it into context from the just created credential file
 ctxt.load_attribute_file("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.der")
 print attr.string() 
@@ -53,4 +69,5 @@
 
 #################################################
+# Credential 2
 #[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
 head = ABAC.Role(acme,"preferred_customer")
@@ -66,4 +83,5 @@
 
 #################################################
+# Credential 3
 #[keyid:Acme].role:preferred_customer <- [keyid:Batman]
 head = ABAC.Role(acme,"preferred_customer")
@@ -80,4 +98,5 @@
 
 ################################################
+# Credential 4
 #[keyid:WarnerBros].role:character <- [keyid:Coyote]
 head=ABAC.Role(warnerbros,"character")
@@ -87,10 +106,9 @@
 attr.attribute_bake()
 attr.attribute_write_cert("WarnerBros_character__Coyote_attr.der")
-#ctxt.load_attribute_file("WarnerBros_character__Coyote_attr.der")
+
+# demonstrate how attribute can be load from structure insted of a file
 ctxt.load_attribute(attr)
-#print attr.string() 
-#print attr.typed_string()
-#print "\n"
+print attr.string() 
+print attr.typed_string()
+print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/acme_rockets_intersection_rt0/intersect.save
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/intersect.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_intersection_rt0/intersect.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,15 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAcme,keyid,y) 
+(pBatman,keyid,y) 
+(pCoyote,keyid,y) 
+(pWarnerBros,keyid,y) 
+
+...final policy attribute set...
+pAcme.buy_rockets <- pAcme.preferred_customer & pWarnerBros.character
+pAcme.preferred_customer <- pBatman
+pAcme.preferred_customer <- pCoyote
+pWarnerBros.character <- pCoyote
 
 ===good============ Acme.buy_rockets <- Coyote
@@ -9,18 +21,2 @@
 ===bad============ Acme.buy_rockets <- Batman
 YAP query failed
-
-...final principal set...
-(pAcme,keyid,y) 
-(pBatman,keyid,y) 
-(pCoyote,keyid,y) 
-(pWarnerBros,keyid,y) 
-
-
-
-...final policy attribute set...
-pAcme.buy_rockets <- pAcme.preferred_customer & pWarnerBros.character
-pAcme.preferred_customer <- pBatman
-pAcme.preferred_customer <- pCoyote
-pWarnerBros.character <- pCoyote
-
-
Index: examples/python_tests/acme_rockets_intersection_rt0/query.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,9 +2,8 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
 cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
-
 """
 
@@ -14,10 +13,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 acmeID=ABAC.ID("Acme_ID.pem");
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -37,4 +40,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# can coyote buy rockets from Acme ?
 # role = "[keyid:Acme].role:buy_rockets"
 # p = "[keyid:coyote]" 
@@ -50,4 +66,5 @@
 
 ##########################################################################
+# can batman buy rockets from Acme ?
 # role = "[keyid:Acme].role:buy_rockets"
 # p = "[keyid:batman]" 
@@ -61,19 +78,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
-
Index: examples/python_tests/acme_rockets_intersection_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/acme_rockets_intersection_rt0/setup.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  Setup 4 principal ID credentials
-
-  Acme, Coyote, WarnerBros and Batman
+See README for the semantics.  This creates four principals used
+by the example.
 
 """
Index: examples/python_tests/acme_rockets_rt0/README
===================================================================
--- examples/python_tests/acme_rockets_rt0/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_rt0/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,10 +1,10 @@
-#!/bin/sh
 #
 # The example makes use of 2 principals, Acme and Coyote.
 #
 # This example shows a very simple delegation of roles by Acme.  Acme's
-# buy_rockets role includes all of Acme's preferred customers.  The example
-# creates the principals and 2 credentials.  Credential 1 encodes the policy
-# that all of Acme's preferred customers can buy rockets from Acme and
+# buy_rockets role includes all of Acme's preferred customers.  The setup.py
+# creates the principals and the attr.py creates 2 policy credentials.  
+# Credential 1 encodes the policy that all of Acme's preferred customers 
+# can buy rockets from Acme and
 # Credential 2 defines the Coyote as an Acme preferred customer.
 
@@ -14,21 +14,10 @@
 # something other than a principal works (it doesn't).
 
-# acme_rockets_rt0_typed
+# acme_rockets_rt0
 
-creddy --generate --cn Acme
-creddy --generate --cn Coyote
+# Credential 1
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
 
-#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
-# Credential 1
-creddy --attribute \
-       --issuer Acme_ID.pem --key Acme_private.pem --role buy_rockets \
-       --subject-cert Acme_ID.pem --subject-role preferred_customer \
-       --out Acme_buy_rockets__Acme_preferred_customer_attr.der
+# Credential 2
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
 
-#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
-# Credential 2
-creddy --attribute \
-       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
-       --subject-cert Coyote_ID.pem \
-       --out Acme_preferred_customer__Coyote_attr.der
-
Index: examples/python_tests/acme_rockets_rt0/attr.py
===================================================================
--- examples/python_tests/acme_rockets_rt0/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_rt0/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,17 +2,16 @@
 
 """
-  Setup access policy attribute rules
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
-
 """
 import os
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
+# retrieve principals' keyid value from local credential files
 acmeID=ABAC.ID("Acme_ID.pem");
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -26,11 +25,20 @@
 
 ################################################
+# Credential 1, only preferred_customer of Acme can buy_rockets
 #[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer
 head = ABAC.Role(acme,"buy_rockets")
 tail = ABAC.Role(acme,"preferred_customer")
+
+# compose the attribute of a basic rt0 role rule
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# create a policy file at the file system
 attr.attribute_write_cert("Acme_buy_rockets__Acme_preferred_customer_attr.der")
+
+# load the policy into current context by with the newly created policy file
 ctxt.load_attribute_file("Acme_buy_rockets__Acme_preferred_customer_attr.der")
 print attr.string() 
@@ -39,4 +47,5 @@
 
 #################################################
+# Credential 2
 #[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
 head = ABAC.Role(acme,"preferred_customer")
@@ -51,4 +60,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/acme_rockets_rt0/query.py
===================================================================
--- examples/python_tests/acme_rockets_rt0/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_rt0/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 acmeID=ABAC.ID("Acme_ID.pem");
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -29,4 +33,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is coyote a preferred_customer of Acme ?
 # role=[keyid:Acme].role:preferred_customer
 # p =[keyid:coyote]
@@ -39,4 +56,5 @@
 
 ##########################################################################
+# can coyote buy rockets from Acme ?
 # role=[keyid:Acme].role:buy_rockets
 # p =[keyid:coyote]
@@ -50,4 +68,5 @@
 
 ##########################################################################
+# is Acme a friend of coyote ?
 # role=[keyid:Coyote].role:friend
 # p=[keyid:Acme] 
@@ -59,18 +78,14 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
 ##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
+# using complex role to ask a question.. expecting to fail 
+# role=[keyid:Acme].role:buy_rockets 
+# p=[keyid:Acme].role:preferred_customer
+role = ABAC.Role(acme,"buy_rockets")
+p = ABAC.Role(acme,"preferred_customer")
+print "\n===bad=============== Acme.buy_rockets <- Acme.preferred_customer"
+out = ctxt.query(role, p)
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
 
 
Index: examples/python_tests/acme_rockets_rt0/rocket.save
===================================================================
--- examples/python_tests/acme_rockets_rt0/rocket.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_rt0/rocket.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,11 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAcme,keyid,y) 
+(pCoyote,keyid,y) 
+
+...final policy attribute set...
+pAcme.buy_rockets <- pAcme.preferred_customer
+pAcme.preferred_customer <- pCoyote
 
 ===good============ Acme.preferred_customer <- Coyote
@@ -13,13 +21,4 @@
 YAP query failed
 
-...final principal set...
-(pAcme,keyid,y) 
-(pCoyote,keyid,y) 
-
-
-
-...final policy attribute set...
-pAcme.buy_rockets <- pAcme.preferred_customer
-pAcme.preferred_customer <- pCoyote
-
-
+===bad=============== Acme.buy_rockets <- Acme.preferred_customer
+fail, a.o <- b.o and a.r <- a.r query is not implemented yet !!!
Index: examples/python_tests/acme_rockets_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_rt0/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_rt0/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/acme_rockets_rt0/setup.py
===================================================================
--- examples/python_tests/acme_rockets_rt0/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/acme_rockets_rt0/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,8 +2,6 @@
 
 """
-  Setup 4 principal ID credentials
-
-  Acme, Coyote, WarnerBros and Batman
-
+See README for the semantics. 
+sets up 2 (Acme, Coyote) principal ID credentials
 """
 import os
@@ -12,7 +10,7 @@
 ctxt = ABAC.Context()
 
-alpha=ABAC.ID("Acme", 0)
-alpha.id_write_cert("Acme_ID.pem")
-alpha.id_write_privkey("Acme_private.pem")
+acme=ABAC.ID("Acme", 0)
+acme.id_write_cert("Acme_ID.pem")
+acme.id_write_privkey("Acme_private.pem")
 
 coyote=ABAC.ID("Coyote", 0)
Index: examples/python_tests/alice_rt1/README
===================================================================
--- examples/python_tests/alice_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alice_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,53 +1,61 @@
-#!/bin/sh
-
-## trying out different data param types
-
-# alice_rt1_typed
-
-creddy --generate --cn Alice
-creddy --generate --cn Hatter
-creddy --generate --cn MarchHare
-creddy --generate --cn Dormouse
-creddy --generate --cn Tea
-creddy --generate --cn Party 
-
-alice_keyid=`creddy --keyid --cert Alice_ID.pem`
-party_keyid=`creddy --keyid --cert Party_ID.pem`
-tea_keyid=`creddy --keyid --cert Tea_ID.pem`
-hatter_keyid=`creddy --keyid --cert Hatter_ID.pem`
-marchhare_keyid=`creddy --keyid --cert MarchHare_ID.pem`
-dormouse_keyid=`creddy --keyid --cert Dormouse_ID.pem`
-
-friendof_alice="friendOf-alice([keyid:$alice_keyid])"
-friendof_marchhare="friendOf([keyid:$marchhare_keyid])"
-guestof_marchhare="guestOf([keyid:$marchhare_keyid])"
-
-about_party="about([keyid:$tea_keyid],[time:20101010T],[boolean:true],[integer:4],[float:-200.0],[float:8],[time:20120205T182930],[string:'guest list'],[urn:'file://usr/local/party/~teaparty'])"
-
-about_other_party="about_other_party([keyid:$tea_keyid],[?],[integer:99],[time:?AAA],[integer:?BBB],[boolean:true],[integer:?])"
-
-about_time="about_time([time:20201101T])"
-about_another_time="about_another_time([time:20201101T182930])"
-about_key="about_key([keyid:$tea_keyid])"
-about_boolean="about_boolean([boolean:true])"
-about_integer="about_integer([integer:4])"
-about_another_integer="about_another_integer([integer:-7])"
-about_float="about_float([float:-200.0])"
-about_another_float="about_another_float([float:8])"
-about_third_float="about_another_float([float:0.22])"
-about_urn="about_urn([urn:'file://user/local/party/~sillyparty'])"
-about_string="about_string([string:'a confused party'])"
-about_string2="about_string([string:'a mangled \'string\''])"
+#
+# trying out different data param types
+#
+# alice_rt1
+#
+# 
+# [keyid:Party].role: about([keyid:tea],[time:20101010T],[boolean:true],[integer:4],
+#                  [float:-200.0],[float:8],[time:20120205T182930],[string:'a list'],
+#                  [urn:'file://usr/party/~teaparty'])
+#                  <- [keyid:Party].role:guestOf([keyid:MarchHare])
+#
+# [keyid:Party].role:about_other_party([keyid:tea],[?],[integer:99],[time:?AAA],
+#                  [integer:?BBB],[boolean:true],[integer:?]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_string([string:'a confused party']) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_string2([string:'a mangled \\'string\\''])
+#                 <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_urn([urn:'file://user/local/party/~sillyparty'])
+#                 <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_another_float([float:0.22]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_another_float([float:8]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_float([float:-200.0]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_another_integer([integer:-7]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_integer([integer:4]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_boolean([boolean:true]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_key([keyid:tea]) <- [keyid:MarchHare] 
+#
+# [keyid:Party].role:about_another_time([time:20201101T182930]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:about_time([time:20201101T]) <- [keyid:MarchHare]
+#
+# [keyid:Party].role:guestof([principal:?V]) 
+#                           <- [keyid:Party].role:friendOf([principal:?V])
+#
+# [keyid:Party].role:guests <- [keyid:Party].role:friendOf([keyid:MarchHare])
+#
+# [keyid:Party].role:friendOf([keyid:MarchHare]) <- [keyid:Dormouse]
+#
+# [keyid:Party].role:friendOf([keyid:Alice]) <- [keyid:Hatter]
 
 
-#[keyid:Party].role:about([keyid:tea],[time:201010],[string:'guest list'],[boolean:true],[integer:4]) <- [keyid:Party].role:guestOf([keyid:MarchHare])
-#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_party\" --subject-cert Party_ID.pem --subject-role  \"$guestof_marchhare\" --out party_about_party__guestof_marchhare_attr.der"
-creddy --attribute \
-       --issuer Party_ID.pem --key Party_private.pem --role "$about_party" \
-       --subject-cert Party_ID.pem --subject-role  "$guestof_marchhare" \
-       --out party_about_party__guestof_marchhare_attr.der
-#echo "  "
-#echo "double checking with creddy --roles -certs party_about_party__guestof_marchhare_attr.der"
-#creddy --roles --cert party_about_party__guestof_marchhare_attr.der
+
+
+
+
+
+
+
+
+
 
 #[keyid:Party].role:about_other_party([keyid:$tea_keyid],[time:?],[boolean:true]) <- [keyid:MarchHare]
Index: examples/python_tests/alice_rt1/alice.save
===================================================================
--- examples/python_tests/alice_rt1/alice.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alice_rt1/alice.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,11 +1,3 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
-
-===good============ Party.guests <- dourmouse
-YAP query succeed
-pParty.guests <- pParty.friendOf(pMarchhare)
-pParty.friendOf(pMarchhare) <- pDormouse
-
-===bad============ Party.guests <- hatter
-YAP query failed
 
 ...final principal set...
@@ -16,6 +8,4 @@
 (pParty,keyid,y) 
 (pTea,keyid,y) 
-
-
 
 ...final policy attribute set...
@@ -28,5 +18,5 @@
 pParty.about_key(pTea) <- pMarchhare
 pParty.about_other_party(pTea,_,99,AAA,BBB,true,_) <- pMarchhare
-pParty.about(pTea,time(2010,10,10,00,00,00),true,4,-200.0,8,time(2012,02,05,18,29,30),'guest','file://usr/party/~teaparty') <- pParty.guestOf(pMarchhare)
+pParty.about(pTea,time(2010,10,10,00,00,00),true,4,-200.0,8,time(2012,02,05,18,29,30),'a list','file://usr/party/~teaparty') <- pParty.guestOf(pMarchhare)
 pParty.about_string2('a mangled \'string\'') <- pMarchhare
 pParty.about_string('a confused party') <- pMarchhare
@@ -39,3 +29,9 @@
 pParty.guests <- pParty.friendOf(pMarchhare)
 
+===good============ Party.guests <- dourmouse
+YAP query succeed
+pParty.guests <- pParty.friendOf(pMarchhare)
+pParty.friendOf(pMarchhare) <- pDormouse
 
+===bad============ Party.guests <- hatter
+YAP query failed
Index: examples/python_tests/alice_rt1/attr.py
===================================================================
--- examples/python_tests/alice_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alice_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,8 +2,8 @@
 
 """
-  Setup access policy attribute rules
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
-
 """
 
@@ -11,11 +11,14 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
-
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+
+# retrieve principals' keyid value from local credential files
 out = ctxt.context_principals()
 print "...initial principal set..."
@@ -59,7 +62,9 @@
 # and could not push/pull out of ietf_attribute_t properly
 ###############################################
+# NOTE: space and '~' in string value
+#       time value's optional ending
 # [keyid:Party].role: about([keyid:tea],[time:20101010T],[boolean:true],
 #                           [integer:4],[float:-200.0],[float:8],[time:20120205T182930],
-#                           [string:'guest'],[urn:'file://usr/party/~teaparty'])
+#                           [string:'a list'],[urn:'file://usr/party/~teaparty'])
 #                <- [keyid:Party].role:guestOf([keyid:MarchHare])
 head=ABAC.Role(party,"about")
@@ -78,5 +83,5 @@
 param=ABAC.DataTerm("time","20120205T182930")
 head.role_add_data_term(param)
-param=ABAC.DataTerm("string","'guest'")
+param=ABAC.DataTerm("string","'a list'")
 head.role_add_data_term(param)
 param=ABAC.DataTerm("urn","'file://usr/party/~teaparty'")
@@ -95,4 +100,6 @@
 
 ###############################################
+# NOTE: anonymous parameter
+#       Variable value for different parameter types
 # [keyid:Party].role:about_other_party([keyid:tea],[?],
 #                         [integer:99],[time:?AAA],[integer:?BBB],
@@ -141,4 +148,5 @@
 
 ###############################################
+# NOTE: how to escape within a string value
 # [keyid:Party].role:about_string2([string:'a mangled \\'string\\''])
 #                 <- [keyid:MarchHare]
@@ -317,4 +325,5 @@
 
 ###############################################
+# NOTE: principal parameter type
 # [keyid:Party].role:guestof([principal:?V]) 
 #           <- [keyid:Party].role:friendOf([principal:?V])
@@ -370,4 +379,5 @@
 
 ###############################################
+# NOTE: named principal tail
 # [keyid:Party].role:friendOf([keyid:Alice]) 
 #                               <- [keyid:Hatter]
@@ -386,4 +396,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/alice_rt1/query.py
===================================================================
--- examples/python_tests/alice_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alice_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 aliceID=ABAC.ID("Alice_ID.pem")
 aliceID.id_load_privkey_file("Alice_private.pem")
@@ -44,7 +48,18 @@
 dormouse=dormouseID.id_keyid()
 
-
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
 
 ##########################################################################
+# can dormouse be a guest at the party ?
 # role=[keyid:Party].role:guests 
 # p=[keyid:dormouse]
@@ -57,4 +72,5 @@
 
 ##########################################################################
+# can hatter be a guest at the party ?
 # role=[keyid:Party].role:guests 
 # p=[keyid:hatter]
@@ -66,16 +82,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
Index: examples/python_tests/alice_rt1/run_test
===================================================================
--- examples/python_tests/alice_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alice_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/alice_rt1/setup.py
===================================================================
--- examples/python_tests/alice_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alice_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,6 +2,5 @@
 
 """
-  Setup principal ID credentials
-
+See README for the semantics.  This creates many principals.
 """
 import os
Index: examples/python_tests/alumni2_rt1/README
===================================================================
--- examples/python_tests/alumni2_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni2_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,2 @@
-#!/bin/sh
 #
 # This example shows an example of reasoning about a role's parameters.  There
@@ -14,56 +13,20 @@
 # psychology degree).
 #
-# The attached ./run_query file asks if each of these principals are favored
+# The query.py file asks if each of these principals are favored
 # alums, and only Bob is.
 
-# alumni2_rt1_typeD
+# alumni2_rt1
 
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+# Credential #1
+# [keyid:stateU].role:foundingAlumni 
+#       <- [keyid:stateU].role:diploma([?], [integer:?Year:[1960,1961,1963]])
 
-creddy --generate --cn StateU
-creddy --generate --cn Bob
-creddy --generate --cn Maryann
-creddy --generate --cn Joe
+# Credential 2
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
 
-stateU_keyid=`creddy --keyid --cert StateU_ID.pem`
-bob_keyid=`creddy --keyid --cert Bob_ID.pem`
-maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
-joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+# Credential 3
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
 
-diploma_q_qY="diploma([?], [integer:?Year:[1960,1961,1963]])"
+# Credential 4
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
 
-diploma_m="diploma([string:'mathmatics'],[integer:1961])"
-diploma_z="diploma([string:'zoology'],[integer:1955])"
-diploma_p="diploma([string:'psychology'],[integer:1962])"
-
-# [keyid:stateU].role:foundingAlumni 
-#                   <- [keyid:stateU].role:diploma([?], [integer:?Year:[1960,1961,1963]])
-# Credential 1
-creddy --attribute \
-       --issuer StateU_ID.pem --key StateU_private.pem --role "foundingAlumni" \
-       --subject-cert StateU_ID.pem --subject-role "$diploma_q_qY" \
-       --out StateU_foundingAlumni__stateU_diploma_q_qY_attr.der
-
-# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
-# Credential 2
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_m" \
-        --subject-cert Bob_ID.pem \
-        --out StateU_diploma_m__Bob_attr.der
-
-# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
-# Credential 3
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_z" \
-        --subject-cert Joe_ID.pem \
-        --out StateU_diploma_m__Joe_attr.der
-
-# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
-# Credential 4
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_p" \
-        --subject-cert Maryann_ID.pem \
-        --out StateU_diploma_m__Maryann_attr.der
-
Index: examples/python_tests/alumni2_rt1/alumni2.save
===================================================================
--- examples/python_tests/alumni2_rt1/alumni2.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni2_rt1/alumni2.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,15 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pBob,keyid,y) 
+(pJoe,keyid,y) 
+(pMaryann,keyid,y) 
+(pStateU,keyid,y) 
+
+...final policy attribute set...
+pStateU.diploma('mathmatics',1961) <- pBob
+pStateU.diploma('psychology',1962) <- pMaryann
+pStateU.diploma('zoology',1955) <- pJoe
+pStateU.foundingAlumni <- pStateU.diploma(_,Year:[1963,1961,1960])
 
 ===good============ stateU.foundingAlumni <- Bob
@@ -11,18 +23,2 @@
 ===bad============ stateU.foundingAlumni <- Joe
 YAP query failed
-
-...final principal set...
-(pBob,keyid,y) 
-(pJoe,keyid,y) 
-(pMaryann,keyid,y) 
-(pStateU,keyid,y) 
-
-
-
-...final policy attribute set...
-pStateU.diploma('mathmatics',1961) <- pBob
-pStateU.diploma('psychology',1962) <- pMaryann
-pStateU.diploma('zoology',1955) <- pJoe
-pStateU.foundingAlumni <- pStateU.diploma(_,Year:[1963,1961,1960])
-
-
Index: examples/python_tests/alumni2_rt1/attr.py
===================================================================
--- examples/python_tests/alumni2_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni2_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,8 +2,8 @@
 
 """
-  Setup access policy attribute rules
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
-
 """
 
@@ -11,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -30,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 stateUID=ABAC.ID("StateU_ID.pem")
 stateUID.id_load_privkey_file("StateU_private.pem")
@@ -48,12 +51,23 @@
 
 ################################################
+# Credential 1, Any alumni of stateU is a member of foundingAlumni if
+# they have diploma from those specific years
 # [keyid:stateU].role:foundingAlumni
-#                   <- [keyid:stateU].role:diploma([?], [integer:?Year:[1960,1961,1963]])
+#       <- [keyid:stateU].role:diploma([?], [integer:?Year:[1960,1961,1963]])
 head = ABAC.Role(stateU,"foundingAlumni")
+
+# constructing an anonymous parameter
 param1=ABAC.DataTerm("anonymous", "_")
+
+# initialize a integer range constraint
 cond=ABAC.Constraint("integer")
+
+# add specific target value for the integer range constraint
 cond.constraint_add_integer_target(1960)
 cond.constraint_add_integer_target(1961)
 cond.constraint_add_integer_target(1963)
+
+# create a paramter term that has a range constraint on it,
+# the variable name supplied has to start with a capitalized alphabet character
 param2=ABAC.DataTerm("integer", "Year", cond)
 tail = ABAC.Role(stateU,"diploma")
@@ -61,5 +75,9 @@
 tail.role_add_data_term(param2)
 attr=ABAC.Attribute(head, 1800)
+
+# construct the attribute
 attr.attribute_add_tail(tail)
+
+# finalize the attribute
 attr.attribute_bake()
 attr.attribute_write_cert("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
@@ -70,4 +88,5 @@
 
 #################################################
+# Credential 2
 # [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
 param1=ABAC.DataTerm("string", "'mathmatics'")
@@ -87,4 +106,5 @@
 
 #################################################
+# Credential 3
 # [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
 param1=ABAC.DataTerm("string", "'zoology'")
@@ -104,4 +124,5 @@
 
 #################################################
+# Credential 4
 # [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
 param1=ABAC.DataTerm("string", "'psychology'")
@@ -120,4 +141,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/alumni2_rt1/query.py
===================================================================
--- examples/python_tests/alumni2_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni2_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 stateUID=ABAC.ID("StateU_ID.pem")
 stateUID.id_load_privkey_file("StateU_private.pem")
@@ -37,4 +41,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is bob a founding alumni of stateU ?
 # role=[keyid:stateU].role:foundingAlumni
 # p=[keyid:Bob] 
@@ -47,4 +64,5 @@
 
 ##########################################################################
+# is maryann a founding alumni of stateU ?
 # role=[keyid:stateU].role:foundingAlumni
 # p=[keyid:Maryann] 
@@ -57,4 +75,5 @@
 
 ##########################################################################
+# is joe a founding alumni of stateU ?
 # role=[keyid:stateU].role:foundingAlumni
 # p=[keyid:Joe] 
@@ -65,18 +84,2 @@
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
Index: examples/python_tests/alumni2_rt1/run_test
===================================================================
--- examples/python_tests/alumni2_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni2_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/alumni2_rt1/setup.py
===================================================================
--- examples/python_tests/alumni2_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni2_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,6 +2,6 @@
 
 """
-  Setup 4 principal ID credentials
-
+See README for the semantics.  This creates 4 principals
+used by the example.
 """
 import os
Index: examples/python_tests/alumni3_rt1/README
===================================================================
--- examples/python_tests/alumni3_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni3_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,90 +1,40 @@
-#!/bin/sh
 #
-# This example shows an example of reasoning about a role's parameters.  There
-# are 4 principals StateU, Bob, Mark, Maryann, Joe, and Jan.  StateU wants to
-# establish a set of founding alumni based on the year of graduation.  On
-# graduation each alum has previously been issued a credential parameterized
-# with their major and graduation year.  StateU sets up a policy that says that
-# a principal is a founding alum if they graduated in 1960, 1961, or 1963 in
-# either mathematics or psychology.  One assumes there was some kind of NCAA
-# suspension in 1962.  This policy is expressed in Credential 1.
+# This example shows an example of reasoning about a role's parameters with
+# range constraints.  There are 6 principals StateU, Bob, Mark, Maryann, 
+# Joe, and Jan.  StateU wants to establish a set of founding alum 
+# based on the year of graduation.  On graduation each alum has previously 
+# been issued a credential parameterized with their major and graduation year.
+# StateU sets up a policy that says that  a principal is a founding alumni
+# if they graduated in 1960, 1961, or 1963 in either mathematics or psychology
+# only.  One assumes there was some kind of NCAA suspension in 1962.  This 
+# policy is expressed in Credential 1.
 #
 # Credentials 2, 3, 4, 5, and 6 each assign a diploma credential to Bob (a 1961
-# mathematics degree), Mark (a 1965 mathematics degree), Joe (a 1961 zoology degree), Maryann (a 1962 psychology degree), and Jan (a 1960 psychology degree)
+# mathematics degree), Mark (a 1965 mathematics degree), Joe (a 1961 zoology degree),
+# Maryann (a 1962 psychology degree), and Jan (a 1960 psychology degree)
 #
-# The attached ./run_query file asks if each of these principals are favored
-# alums, and only Bob and Jan are.
+# The query.py asks if each of these principals are favored alums, and only 
+# Bob and Jan are.
 
-# alumni3_rt1_typed
+# alumni3_rt1
 
-rm -rf *.der *.pem
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+# Credential 1
+# [keyid:stateU].role:foundingAlumni 
+#              <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']],
+#                                        [integer:?Year:[1960,1961,1963]])
 
-creddy --generate --cn StateU
-creddy --generate --cn Bob
-creddy --generate --cn Mark
-creddy --generate --cn Joe
-creddy --generate --cn Maryann
-creddy --generate --cn Jan
+# Credential 2
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
 
-stateU_keyid=`creddy --keyid --cert StateU_ID.pem`
+# Credential 3
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
 
-bob_keyid=`creddy --keyid --cert Bob_ID.pem`
-mark_keyid=`creddy --keyid --cert Mark_ID.pem`
-joe_keyid=`creddy --keyid --cert Joe_ID.pem`
-maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
-jan_keyid=`creddy --keyid --cert Jan_ID.pem`
+# Credential 4
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
 
-diploma_q_qY="diploma([string:?D:['mathmatics','psychology']], [integer:?Year:[1960,1961,1963]])"
+# Credential 5
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
 
-diploma_m="diploma([string:'mathmatics'],[integer:1961])"
-diploma_mm="diploma([string:'mathmatics'],[integer:1965])"
-diploma_z="diploma([string:'zoology'],[integer:1961])"
-diploma_p="diploma([string:'psychology'],[integer:1962])"
-diploma_pp="diploma([string:'psychology'],[integer:1960])"
+# Credential 6
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960]) <- [keyid:jan]
 
-# [keyid:stateU].role:foundingAlumni 
-#                   <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']], [integer:?Year:[1960,1961,1963]])
-# Credential 1
-creddy --attribute \
-       --issuer StateU_ID.pem --key StateU_private.pem --role "foundingAlumni" \
-       --subject-cert StateU_ID.pem --subject-role "$diploma_q_qY" \
-       --out StateU_foundingAlumni__stateU_diploma_q_qY_attr.der
-
-# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
-# Credential 2
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_m" \
-        --subject-cert Bob_ID.pem \
-        --out StateU_diploma_m__Bob_attr.der
-
-# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
-# Credential 3
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_mm" \
-        --subject-cert Mark_ID.pem \
-        --out StateU_diploma_mm__Mark_attr.der
-
-# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
-# Credential 4
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_z" \
-        --subject-cert Joe_ID.pem \
-        --out StateU_diploma_z__Joe_attr.der
-
-# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
-# Credential 5
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_p" \
-        --subject-cert Maryann_ID.pem \
-        --out StateU_diploma_p__Maryann_attr.der
-
-# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960]) <- [keyid:jan]
-# Credential 6
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_pp" \
-        --subject-cert Jan_ID.pem \
-        --out StateU_diploma_pp__Jan_attr.der
-
Index: examples/python_tests/alumni3_rt1/alumni3.save
===================================================================
--- examples/python_tests/alumni3_rt1/alumni3.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni3_rt1/alumni3.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,19 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pBob,keyid,y) 
+(pJan,keyid,y) 
+(pJoe,keyid,y) 
+(pMark,keyid,y) 
+(pMaryann,keyid,y) 
+(pStateU,keyid,y) 
+
+...final policy attribute set...
+pStateU.diploma('mathmatics',1961) <- pBob
+pStateU.diploma('mathmatics',1965) <- pMark
+pStateU.diploma('psychology',1960) <- pJan
+pStateU.diploma('psychology',1962) <- pMaryann
+pStateU.diploma('zoology',1961) <- pJoe
+pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
 
 ===good============ stateU.foundingAlumni <- Bob
@@ -19,22 +35,2 @@
 pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
 pStateU.diploma('psychology',1960) <- pJan
-
-...final principal set...
-(pBob,keyid,y) 
-(pJan,keyid,y) 
-(pJoe,keyid,y) 
-(pMark,keyid,y) 
-(pMaryann,keyid,y) 
-(pStateU,keyid,y) 
-
-
-
-...final policy attribute set...
-pStateU.diploma('mathmatics',1961) <- pBob
-pStateU.diploma('mathmatics',1965) <- pMark
-pStateU.diploma('psychology',1960) <- pJan
-pStateU.diploma('psychology',1962) <- pMaryann
-pStateU.diploma('zoology',1961) <- pJoe
-pStateU.foundingAlumni <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960])
-
-
Index: examples/python_tests/alumni3_rt1/attr.py
===================================================================
--- examples/python_tests/alumni3_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni3_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,8 +2,8 @@
 
 """
-  Setup access policy attribute rules
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
-
 """
 
@@ -11,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -30,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 stateUID=ABAC.ID("StateU_ID.pem")
 stateUID.id_load_privkey_file("StateU_private.pem")
@@ -56,23 +59,44 @@
 
 ################################################
+# Credential 1, this policy has two range constraints on different parameters
 # [keyid:stateU].role:foundingAlumni
 #              <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']],
 #                                             [integer:?Year:[1960,1961,1963]])
 head = ABAC.Role(stateU,"foundingAlumni")
+
+# initialize a string range constraint
 cond=ABAC.Constraint("string")
+
+# add specific string values to the constraint
 cond.constraint_add_string_target("'mathmatics'")
 cond.constraint_add_string_target("'psychology'")
+
+# create the parameter with the string range constraint
 param1=ABAC.DataTerm("string", "D", cond)
+
+# initialize another constratnt that is of integer type
 cond=ABAC.Constraint("integer")
+
+# add specific integer values to the constraint
 cond.constraint_add_integer_target(1960)
 cond.constraint_add_integer_target(1961)
 cond.constraint_add_integer_target(1963)
+
+# create the parameter with the integer range constraint
 param2=ABAC.DataTerm("integer", "Year", cond)
 tail = ABAC.Role(stateU,"diploma")
+
+# add the parameter with conditions to a role
 tail.role_add_data_term(param1)
 tail.role_add_data_term(param2)
+
+# build up the policy rule
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the policy rule
 attr.attribute_bake()
+
+# save it to a credential file
 attr.attribute_write_cert("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
 ctxt.load_attribute_file("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
@@ -82,4 +106,5 @@
 
 #################################################
+# Credential 2
 # [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
 param1=ABAC.DataTerm("string", "'mathmatics'")
@@ -99,4 +124,5 @@
 
 #################################################
+# Credential 3
 # [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
 param1=ABAC.DataTerm("string", "'mathmatics'")
@@ -116,4 +142,5 @@
 
 #################################################
+# Credential 4
 # [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
 param1=ABAC.DataTerm("string", "'zoology'")
@@ -133,5 +160,7 @@
 
 #################################################
-# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
+# Credential 5
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962])
+#                             <- [keyid:maryann]
 param1=ABAC.DataTerm("string", "'psychology'")
 param2=ABAC.DataTerm("integer", "1962")
@@ -151,5 +180,7 @@
 
 #################################################
-# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960]) <- [keyid:jan]
+# Credential 6
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960])
+#                              <- [keyid:jan]
 param1=ABAC.DataTerm("string", "'psychology'")
 param2=ABAC.DataTerm("integer", "1960")
@@ -167,5 +198,2 @@
 print "\n"
 
-
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/alumni3_rt1/query.py
===================================================================
--- examples/python_tests/alumni3_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni3_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 stateUID=ABAC.ID("StateU_ID.pem")
 stateUID.id_load_privkey_file("StateU_private.pem")
@@ -43,4 +47,16 @@
 janID.id_load_privkey_file("Jan_private.pem")
 jan=janID.id_keyid()
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
 
 ##########################################################################
@@ -94,18 +110,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
Index: examples/python_tests/alumni3_rt1/run_test
===================================================================
--- examples/python_tests/alumni3_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni3_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/alumni3_rt1/setup.py
===================================================================
--- examples/python_tests/alumni3_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni3_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,6 +2,6 @@
 
 """
-  Setup 4 principal ID credentials
-
+See README for the semantics.  This creates many principals
+used by the example.
 """
 import os
Index: examples/python_tests/alumni_rt1/README
===================================================================
--- examples/python_tests/alumni_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,11 +1,11 @@
-#!/bin/sh
 #
-# This example shows an example of reasoning about a role's parameters.  There
-# are 4 principals StateU, Bob, Maryann, and Joe.  StateU wants to establish a
-# set of founding alumni based on the year of graduation.  On graduation each
-# alum has previously been issued a credential parameterized with their major
-# and graduation year.  StateU sets up a policy that says that a principal is a
-# founding alum if they graduated in 1955 through 1958 inclusive no matter what
-# major the principal had.  This policy is expressed in Credential 1.
+# This example shows an example of reasoning about a role's parameters with
+# a range constraint.  There are 4 principals StateU, Bob, Maryann, and Joe.
+# StateU wants to establish a  set of founding alum based on the year of 
+# graduation.  On graduation each alum has previously been issued a 
+# credential parameterized with their major and graduation year.  StateU 
+# sets up a policy that says that a principal is a founding alum if they 
+# graduated in 1955 through 1958 inclusive no matter what major the 
+# principal had.  This policy is expressed in Credential 1.
 #
 # Credentials 2, 3, and 4 each assign a diploma credential to Bob (a 1960
@@ -13,78 +13,19 @@
 # psychology degree).
 #
-# The attached ./run_query file asks if each of these principals are favored
+# The query.py file asks if each of these principals are favored
 # alums and Joe and Maryann are.
 
-# alumni_rt1_typed
+# alumni_rt1
 
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (no)
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (yes)
-# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (yes)
-
-creddy --generate --cn StateU
-creddy --generate --cn Bob
-creddy --generate --cn Maryann
-creddy --generate --cn Joe
-
-stateU_keyid=`creddy --keyid --cert StateU_ID.pem`
-bob_keyid=`creddy --keyid --cert Bob_ID.pem`
-maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
-joe_keyid=`creddy --keyid --cert Joe_ID.pem`
-
-diploma_q_qY="diploma([?], [integer:?Year:[1955..1958]])"
-
-diploma_m="diploma([string:'mathmatics'],[integer:1960])"
-diploma_z="diploma([string:'zoology'],[integer:1955])"
-diploma_p="diploma([string:'psychology'],[integer:1956])"
-
+# Credential 1
 # [keyid:stateU].role:foundingAlumni 
 #                   <- [keyid:stateU].role:diploma([?], [integer:?Year:[1955..1958]])
-# Credential 1
-creddy --attribute \
-       --issuer StateU_ID.pem --key StateU_private.pem --role "foundingAlumni" \
-       --subject-cert StateU_ID.pem --subject-role "$diploma_q_qY" \
-       --out StateU_foundingAlumni__stateU_diploma_q_qY_attr.der
 
+# Credential 2
 # [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1960]) <- [keyid:bob]
-# Credential 2
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_m" \
-        --subject-cert Bob_ID.pem \
-        --out StateU_diploma_m__Bob_attr.der
 
+# Credential 3
 # [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
-# Credential 3
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_z" \
-        --subject-cert Joe_ID.pem \
-        --out StateU_diploma_m__Joe_attr.der
 
+# Credential 4
 # [keyid:stateU].role:diploma([string:'psychology'],[integer:1956]) <- [keyid:maryann]
-# Credential 4
-creddy --attribute \
-        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_p" \
-        --subject-cert Maryann_ID.pem \
-        --out StateU_diploma_m__Maryann_attr.der
-
-
-#####################################################################
-# stateU.foundingAlumni <- stateU.diploma(?, ?Year:[1955..1958])
-# [keyid:stateU].role:foundingAlumni 
-#                <- [keyid:stateU].role:diploma([?], [integer:?Year:[1955..1958]])
-# 
-# stateU.diploma(mathmatics,1960)<-bob
-# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1960]) <- [keyid:bob]
-# 
-# stateU.diploma(zoology,1955)<-joe
-# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
-#
-# stateU.diploma(psychology,1956)<-maryann
-# [keyid:stateU].role:diploma([string:'psychology'],[integer:1956]) <- [keyid:maryann]
-#
-# query,
-# stateU.foundingAlumni<-?-bob  bad
-# [keyid:stateU].role:foundingAlumni <- [keyid:bob]
-# 
-# stateU.foundingAlumni<-?-maryann  good
-# [keyid:stateU].role:foundingAlumni <- [keyid:maryann]
-#
Index: examples/python_tests/alumni_rt1/alumni.save
===================================================================
--- examples/python_tests/alumni_rt1/alumni.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni_rt1/alumni.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,16 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
   
+...final principal set...
+(pBob,keyid,y) 
+(pJoe,keyid,y) 
+(pMaryann,keyid,y) 
+(pStateU,keyid,y) 
+
+...final policy attribute set...
+pStateU.diploma('mathmatics',1960) <- pBob
+pStateU.diploma('psychology',1956) <- pMaryann
+pStateU.diploma('zoology',1955) <- pJoe
+pStateU.foundingAlumni <- pStateU.diploma(_,Year:[1955 .. 1958])
+
 ===bad============ stateU.foundingAlumni <- Bob
 YAP query failed
@@ -13,18 +25,2 @@
 pStateU.foundingAlumni <- pStateU.diploma(_,Year:[1955 .. 1958])
 pStateU.diploma('zoology',1955) <- pJoe
-
-...final principal set...
-(pBob,keyid,y) 
-(pJoe,keyid,y) 
-(pMaryann,keyid,y) 
-(pStateU,keyid,y) 
-
-
-
-...final policy attribute set...
-pStateU.diploma('mathmatics',1960) <- pBob
-pStateU.diploma('psychology',1956) <- pMaryann
-pStateU.diploma('zoology',1955) <- pJoe
-pStateU.foundingAlumni <- pStateU.diploma(_,Year:[1955 .. 1958])
-
-
Index: examples/python_tests/alumni_rt1/attr.py
===================================================================
--- examples/python_tests/alumni_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,8 +2,8 @@
 
 """
-  Setup access policy attribute rules
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
-
 """
 
@@ -11,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -30,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 stateUID=ABAC.ID("StateU_ID.pem")
 stateUID.id_load_privkey_file("StateU_private.pem")
@@ -48,11 +51,21 @@
 
 ################################################
+# Credential 1, the year is constrainted by a range constraint with min and max 
+#               values
 # [keyid:stateU].role:foundingAlumni
-#                   <- [keyid:stateU].role:diploma([?], [integer:?Year:[1955 .. 1958]])
+#          <- [keyid:stateU].role:diploma([?], [integer:?Year:[1955 .. 1958]])
 head = ABAC.Role(stateU,"foundingAlumni")
+
+# create an anonymous parameter that will take any type of major
 param1=ABAC.DataTerm("anonymous", "_")
+
+# initialize a constraint with integer type
 cond=ABAC.Constraint("integer")
+
+# set the bounding min and max value for this constraint
 cond.constraint_add_integer_min(1955)
 cond.constraint_add_integer_max(1958)
+
+# make the parameter with this integer constraint
 param2=ABAC.DataTerm("integer", "Year", cond)
 tail = ABAC.Role(stateU,"diploma")
@@ -60,7 +73,15 @@
 tail.role_add_data_term(param2)
 attr=ABAC.Attribute(head, 1800)
+
+# build up the policy
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# write the policy out into the file system
 attr.attribute_write_cert("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
+
+# load this policy into the context using this external credential file
 ctxt.load_attribute_file("StateU_foundingAlumni__stateU_diploma_q_qY_attr.der")
 print attr.string() 
@@ -69,5 +90,7 @@
 
 #################################################
-# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1960]) <- [keyid:bob]
+# Credential 2
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1960]) 
+#                                                            <- [keyid:bob]
 param1=ABAC.DataTerm("string", "'mathmatics'")
 param2=ABAC.DataTerm("integer", "1960")
@@ -86,5 +109,7 @@
 
 #################################################
-# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
+# Credential 3
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) 
+#                                                     <- [keyid:joe]
 param1=ABAC.DataTerm("string", "'zoology'")
 param2=ABAC.DataTerm("integer", "1955")
@@ -103,5 +128,7 @@
 
 #################################################
-# [keyid:stateU].role:diploma([string:'psychology'],[integer:1956]) <- [keyid:maryann]
+# Credential 4
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1956]) 
+#                                                   <- [keyid:maryann]
 param1=ABAC.DataTerm("string", "'psychology'")
 param2=ABAC.DataTerm("integer", "1956")
@@ -119,4 +146,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/alumni_rt1/query.py
===================================================================
--- examples/python_tests/alumni_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 stateUID=ABAC.ID("StateU_ID.pem")
 stateUID.id_load_privkey_file("StateU_private.pem")
@@ -37,4 +41,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is bob a founding alumni of stateU ?
 # role=[keyid:stateU].role:foundingAlumni
 # p=[keyid:Bob] 
@@ -47,4 +64,5 @@
 
 ##########################################################################
+# is maryann a founding alumni of stateU ?
 # role=[keyid:stateU].role:foundingAlumni
 # p=[keyid:Maryann] 
@@ -57,4 +75,5 @@
 
 ##########################################################################
+# is joe a founding alumni of stateU ?
 # role=[keyid:stateU].role:foundingAlumni
 # p=[keyid:Joe] 
@@ -66,17 +85,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
Index: examples/python_tests/alumni_rt1/run_test
===================================================================
--- examples/python_tests/alumni_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/alumni_rt1/setup.py
===================================================================
--- examples/python_tests/alumni_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/alumni_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,8 @@
 
 """
-  Setup 4 principal ID credentials
+See README for the semantics.  This creates principals
+used by the example.
+"""
 
-"""
 import os
 import ABAC
Index: examples/python_tests/balltime_rt2/README
===================================================================
--- examples/python_tests/balltime_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/balltime_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,2 @@
-#!/bin/sh
-#
 #####################################################################
 # This example demonstrates using an oset (object set) to control access
@@ -15,5 +13,5 @@
 # [keyid:League].oset:players(string:'north'))
 # 
-# The example below lays out the policy that players of a given team can
+# The file, attr.py, lays out the policy that players of a given team can
 # go to the stadium when it is their team's gametime -- credential 1.
 # or any player of a team that is controlled by the League principal can
@@ -25,97 +23,33 @@
 # a player for team(south)
 #
-# The attached ./run_query file runs 3 queries.  First it confirms that John can 
+# The query.py file runs 3 queries.  First it confirms that John can 
 # go to stadium at his team's gametime, then it confirms that Mark cannot
 # go because it is not his gametime, but Mark can go to the stadium during
 # stadium's free-for-all early morning time
 
-# balltime_rt2_typed
+# balltime_rt2
 
-creddy --generate --cn League
-creddy --generate --cn John
-creddy --generate --cn Mark
-
-league_keyid=`creddy --keyid --cert League_ID.pem`
-john_keyid=`creddy --keyid --cert John_ID.pem`
-mark_keyid=`creddy --keyid --cert Mark_ID.pem`
-
-stadium_qFqT="stadium([string:'access'],[boolean:true],[time:?F[keyid:$league_keyid].oset:gametime([string:?T])])"
-stadium_qR="stadium([string:'access'],[boolean:?B:[true]],[time:?F:[20120228T080000..20120228T090000]])"
-
-players_qT="players([string:?T])" 
-
+# Credential 1
 #[keyid:league].role:stadium([string:'access'],[boolean:true],
 #          [time:?F:[keyid:league].oset.gametime([string:?T])])
 #                <-[keyid:league].role:players([string:?T])
-# Credential 1
-creddy --attribute \
-       --issuer League_ID.pem --key League_private.pem --role "$stadium_qFqT" \
-       --subject-cert League_ID.pem --subject-role "$players_qT" \
-       --out League_access_qFqT__League_players_qT_attr.der
 
+# Credential 2 
 #[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
 #              [time:?F:[20120228T080000..20120228T090000]])
 #               <- [keyid:league].role:players(string:?T) 
-# Credential 2 
-creddy --attribute \
-       --issuer League_ID.pem --key League_private.pem --role "$stadium_qR" \
-       --subject-cert League_ID.pem --subject-role "$players_qT" \
-       --out League_access_qR__League_players_qT_attr.der
 
-
+# Credential 3
 # [keyid:league].oset:gametime([time:20120228T130000])
 #                    <- [keyid:league].oset:players([string:'north') 
-# Credential 3
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --oset "gametime([string:'north'])" \
-        --subject-obj "[time:20120228T130000]" \
-        --out League_gametime_north__timeT_attr.der
 
+# Credential 4 
 # [keyid:league].oset:gametime([time:20120228T140000])
 #                    <- [keyid:league].oset:players([string:'south') 
-# Credential 4 
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --oset "gametime([string:'south'])" \
-        --subject-obj "[time:20120228T140000]" \
-        --out League_gametime_south__time2T_attr.der
 
+# Credential 5 
 # [keyid:league].role:players([string:'north'])<-[keyid:John]
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --role "players([string:'north'])" \
-        --subject-cert John_ID.pem \
-        --out League_players_north__John_attr.der
 
+# Credential 6 
 # [keyid:league].role:players([string:'south'])<-[keyid:Mark]
-creddy --attribute \
-        --issuer League_ID.pem --key League_private.pem \
-        --role "players([string:'south'])" \
-        --subject-cert Mark_ID.pem \
-        --out League_players_south__Mark_attr.der
 
-#####################################################################
-#league allows member of a team to access stadium at their team's designed time
-#
-#[keyid:league].role:stadium([string:'access'],[boolean:true],
-#          [time:?F:[keyid:league].oset.gametime([string:?T])])
-#                <-[keyid:league].role:players([string:?T])
-#
-#[keyid:league].role:stadium([string:'access'],[time:?Tm]) <- [principal:?P]
-#[keyid:league].oset:gametime(string:?Team) <- [time:?Tm]
-#[keyid:league].role:player(string:?Team) <- [principal:?P]
-#
-#
-#league.stadium(access,?Time:league.gametime(?Team)) <- league.players(?Teams)
-#              league.player(north) <- john
-#              league.player(south) <- mark 
-#              league.gametime(north) <- [time:'20120228T130000']
-#              league.gametime(south) <- [time:'20120228T140000']
-#
-#league.statdium(access,?FreeTime:[20120228T080000..20120228T090000]) 
-#                  <- league.players(_).
-#
-#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true]],
-#              [time:?F:['20120228T080000'..'20120228T090000']])
-#               <- [keyid:league].role:players(string:?T) 
Index: examples/python_tests/balltime_rt2/attr.py
===================================================================
--- examples/python_tests/balltime_rt2/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/balltime_rt2/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,4 +2,7 @@
 
 """
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
 cmd1:env keystore=`pwd` ./attr.py 
 """
@@ -8,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -27,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 leagueID=ABAC.ID("League_ID.pem");
 leagueID.id_load_privkey_file("League_private.pem");
@@ -40,4 +46,5 @@
 
 ################################################
+# Credential 1, oset constraint on a time parameter
 #[keyid:league].role:stadium([string:'access'],[boolean:true],
 #          [time:?F:[keyid:league].oset.gametime([string:?T])])
@@ -46,8 +53,17 @@
 param2=ABAC.DataTerm("boolean","true")
 
+# setup the uninstantiated variable as the oset constraint's parameter
 param=ABAC.DataTerm("string","T")
+
+# make the oset condition
 condoset=ABAC.Oset(league,"gametime")
+
+# add the parameter for the constraint
 condoset.oset_add_data_term(param)
+
+# create the constraint with the oset condition
 cond=ABAC.Constraint(condoset)
+
+# make the data term that is being constrained
 param3=ABAC.DataTerm("time", "F", cond)
 head = ABAC.Role(league,"stadium")
@@ -55,11 +71,16 @@
 head.role_add_data_term(param2)
 head.role_add_data_term(param3)
-
 param=ABAC.DataTerm("string", "T")
 tail = ABAC.Role(league,"players")
 tail.role_add_data_term(param)
+
+# build up the attribute policy
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# create the credential file for this policy
 attr.attribute_write_cert("League_access_qFqT__League_players_qT_attr.der")
 ctxt.load_attribute_file("League_access_qFqT__League_players_qT_attr.der")
@@ -69,12 +90,17 @@
 
 ################################################
-# ??? not sure if this is a valid policy
+# Credential 2, 2 different range constraints, one on a boolean and
+#               and the other is on a time
 #[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
 #              [time:?F:[20120228T080000..20120228T090000]])
 #               <- [keyid:league].role:players(string:?T)
 param1=ABAC.DataTerm("string","'access'")
+
+# generate a range constraint with a single target value
 cond=ABAC.Constraint("boolean")
 cond.constraint_add_boolean_target("true")
 param2=ABAC.DataTerm("boolean", "B", cond)
+
+# generate a range constraint with a min and a max 
 cond=ABAC.Constraint("time")
 cond.constraint_add_time_min("20120228T080000")
@@ -100,4 +126,5 @@
 
 #################################################
+# Credential 3
 # [keyid:league].oset:gametime([string:'north'])
 #                    <- [time:20120228T130000]
@@ -117,4 +144,5 @@
 
 #################################################
+# Credential 4
 # [keyid:league].oset:gametime([string:'south']) 
 #                    <-[time:20120228T140000]
@@ -134,4 +162,5 @@
 
 #################################################
+# Credential 5
 # [keyid:league].role:players([string:'north'])<-[keyid:John]
 param=ABAC.DataTerm("string", "'north'")
@@ -149,4 +178,5 @@
 
 #################################################
+# Credential 6
 # [keyid:league].role:players([string:'south'])<-[keyid:Mark]
 param=ABAC.DataTerm("string", "'south'")
@@ -164,4 +194,2 @@
 
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/balltime_rt2/ball.save
===================================================================
--- examples/python_tests/balltime_rt2/ball.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/balltime_rt2/ball.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,17 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
   
+...final principal set...
+(pJohn,keyid,y) 
+(pLeague,keyid,y) 
+(pMark,keyid,y) 
+
+...final policy attribute set...
+pLeague.stadium('access',true,F:pLeague.gametime(T)) <- pLeague.players(T)
+pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
+pLeague.gametime('north') <- time(2012,02,28,13,00,00)
+pLeague.gametime('south') <- time(2012,02,28,14,00,00)
+pLeague.players('north') <- pJohn
+pLeague.players('south') <- pMark
+
 ===good============ league.stadium(access,true,20120128T130000)<-?-john
 YAP query succeed
@@ -14,19 +27,2 @@
 pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
 pLeague.players('south') <- pMark
-
-...final principal set...
-(pJohn,keyid,y) 
-(pLeague,keyid,y) 
-(pMark,keyid,y) 
-
-
-
-...final policy attribute set...
-pLeague.stadium('access',true,F:pLeague.gametime(T)) <- pLeague.players(T)
-pLeague.stadium('access',B:[true],F:[20120228T080000 .. 20120228T090000]) <- pLeague.players(T)
-pLeague.gametime('north') <- time(2012,02,28,13,00,00)
-pLeague.gametime('south') <- time(2012,02,28,14,00,00)
-pLeague.players('north') <- pJohn
-pLeague.players('south') <- pMark
-
-
Index: examples/python_tests/balltime_rt2/query.py
===================================================================
--- examples/python_tests/balltime_rt2/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/balltime_rt2/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 leagueID=ABAC.ID("League_ID.pem");
 leagueID.id_load_privkey_file("League_private.pem");
@@ -33,4 +37,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# can john go to stadium at 1pm?
 # role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T130000]) 
 # p=[keyid:john]
@@ -49,4 +66,5 @@
 
 ##########################################################################
+# can mark go to stadium at 11am?
 # role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T110000]) 
 # p=[keyid:mark]
@@ -65,4 +83,5 @@
 
 ##########################################################################
+# can mark go to stadium at 8am then?
 # role=[keyid:league].role:stadium([string:'access'],[boolean:true],[time:20120228T080000])
 # p=[keyid:mark]
@@ -79,22 +98,2 @@
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
-
-##########################################################################
-# dump the yap dB
-#
-#ctxt.dump_yap_db()
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
Index: examples/python_tests/balltime_rt2/run_test
===================================================================
--- examples/python_tests/balltime_rt2/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/balltime_rt2/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/balltime_rt2/setup.py
===================================================================
--- examples/python_tests/balltime_rt2/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/balltime_rt2/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,4 +2,6 @@
 
 """
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
Index: examples/python_tests/basic_id/README
===================================================================
--- examples/python_tests/basic_id/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/basic_id/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,9 +1,32 @@
-#!/bin/sh
+#####################################################################
+# This example demonstrates various ways to create and access
+# ID credentials using libabac api
+#  
 
-#####################################################################
-# This example demonstrates various ways to access and create 
-# ID credentials using libabac api using python
-# In yap db, the ID credential is stored as: isType(pIDname,keyid)
+case 1: make ID 
+        writing cert file
+        writing key file
+        load cert, key file
 
+case 2: make ID
+        load ID
 
-#  
+case 3: make ID
+        write key combo file
+        write cert combo file
+        load combo file
+
+case 4: make ID
+        write key unconventional name
+        write cert unconventional name
+        load unconventional filename
+        
+case 5: make ID
+        write cert to combo file
+        load combo file
+
+case 6: make ID
+        write key to combo file
+        load combo file
+
+case 7: load unknown combo file
Index: examples/python_tests/basic_id/id.py
===================================================================
--- examples/python_tests/basic_id/id.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/basic_id/id.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -16,7 +16,13 @@
 print "ABAC version %s" % ctxt.version()
 
-keystore=os.environ["keystore"]
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1) 
 
-ctxt.load_directory(keystore)
 out = ctxt.context_principals()
 print "...initial principal set..."
@@ -25,36 +31,56 @@
 print "\n" 
 
+## creating and writing out using libabac ID
 id=ABAC.ID("Mary", 0)
 print "adding -> %s(good)" % id.id_name()
 id.id_write_cert("Mary_ID.pem")
 id.id_write_privkey("Mary_private.pem")
+## load principal with id/key file pair
+## note, with this, we do not have handle on the keyid
+## to Mary but it will be in the db
 ctxt.load_id_files("Mary_ID.pem","Mary_private.pem")
 
+## creating principal using ID
 nid=ABAC.ID("Jack", 0)
 print "adding -> %s(good)" % nid.id_name()
+## load principal directly with the ID, no external
+## credential files were created
 ctxt.load_id(nid)
 
+## creating principal using ID
 id=ABAC.ID("Mark", 0)
 print "adding -> %s(good)" % id.id_name()
+## write cert and key content to a combo file. One is appended
+## after another
 id.id_write_privkey("Mark_IDKEY.pem")
 id.id_write_cert("Mark_IDKEY.pem")
+## load principal in with the combo file with the tandem format
 ctxt.load_id_file("Mark_IDKEY.pem")
 
+## creating principal using ID
 id=ABAC.ID("John", 0)
 print "adding -> %s(good,invisible)" % id.id_name()
 id.id_write_privkey("John_other.pem")
 id.id_write_cert("John_other.pem")
+## load id without the key file
 ctxt.load_id_file("John_other.pem")
 
+## creating principal using ID
 id=ABAC.ID("Lori", 0)
 print "adding -> %s(good,nokey)" % id.id_name()
+## write just cert into the combo file
 id.id_write_cert("Lori_IDKEY.pem")
+##load principal from a combo file that only contains cert part
 ctxt.load_id_file("Lori_IDKEY.pem")
 
+## creating principal using ID
 id=ABAC.ID("Tom", 0)
 print "adding -> %s(bad,nocert)" % id.id_name()
+## write just key into the combo file
 id.id_write_privkey("Tom_IDKEY.pem")
+## load principal from combo file that only contains key part
 ctxt.load_id_file("Tom_IDKEY.pem")
 
+## failure case, loading a non-existing combo file
 print "adding -> Casper(bad,unknown file)"
 ctxt.load_id_file("Casper_IDKEY.pem")
Index: examples/python_tests/basic_id/run_test
===================================================================
--- examples/python_tests/basic_id/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/basic_id/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 g_cmd_sha=`grep "cmd1:" id.py |sed "s/cmd1://g" `
Index: examples/python_tests/basic_id/setup.py
===================================================================
--- examples/python_tests/basic_id/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/basic_id/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  to test with python
-
-
+See README for the semantics.  This creates principals
+using ID and write out the credential file pair, cert/privkey
 """
 import os
Index: examples/python_tests/evaluator_rt1/README
===================================================================
--- examples/python_tests/evaluator_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/evaluator_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,2 @@
-#!/bin/sh
 #
 # This example demonstrates linking parameterized roles and delegating across
@@ -12,65 +11,28 @@
 # credentials 5 and 6 idicate that John and Maryann are ISI employees.
 # 
-# the attached ./run_query script queries that USC grants John the role of evaluator
+# The query.py script queries that USC grants John the role of evaluator
 # of Maryann, that ISI asserts John is Maryann's manager and that John is an
 # ISI employee.
 
-# evaluator_rt1_typed
+# evaluator_rt1
 
-#[keyid:USC].role:employee <-?- [keyid:John]
-#[keyid:USC].role:evaluatorOf([keyid:Maryann])<-?- [keyid:John]
+# Credential 1
+#[keyid:USC].role:evaluatorOf([principal:?K])
+#                                  <-[keyid:USC].role:managerOf([principal:?K])
 
-creddy --generate --cn ISI
-creddy --generate --cn USC
-creddy --generate --cn Maryann
-creddy --generate --cn John
+# Credential 2
+#[keyid:USC].role:managerOf([principal:?K])
+#                                  <-[keyid:ISI].role:managerOf([principal:?K])
 
-isi_keyid=`creddy --keyid --cert ISI_ID.pem`
-usc_keyid=`creddy --keyid --cert USC_ID.pem`
-maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
-john_keyid=`creddy --keyid --cert John_ID.pem`
+# Credential 3
+#[keyid:ISI].role:managerOf([keyid:Maryann]) <- [keyid:John]
 
-managerof_maryann="managerOf([keyid:$maryann_keyid])"
+# Credential 4
+#[keyid:USC].role:employee <- [keyid:ISI].role:employee
 
-#[keyid:USC].role:evaluatorOf([principal:?K])<-[keyid:USC].role:managerOf([principal:?K])
-# Credential 1
-creddy --attribute \
-       --issuer USC_ID.pem --key USC_private.pem --role 'evaluatorOf([principal:?K])' \
-       --subject-cert USC_ID.pem --subject-role 'managerOf([principal:?K])' \
-       --out USC_evaluatorof_qK__USC_managerof_qK_attr.der
+# Credential 5
+#[keyid:ISI].role:employee  <- [keyid:Maryann]
 
-#[keyid:USC].role:managerOf([principal:?K])<-[keyid:ISI].role:managerOf([principal:?K])
-# Credential 2
-creddy --attribute \
-       --issuer USC_ID.pem --key USC_private.pem --role 'managerOf([principal:?K])' \
-       --subject-cert ISI_ID.pem --subject-role 'managerOf([principal:?K])' \
-       --out USC_managerof_qK__USC_employee_attr.der
+# Credential 6
+#[keyid:ISI].role:employee <- [keyid:John]
 
-#[keyid:ISI].role:managerOf([keyid:Maryann]) <- [keyid:John]
-# Credential 3
-creddy --attribute \
-       --issuer ISI_ID.pem --key ISI_private.pem --role "$managerof_maryann" \
-       --subject-cert John_ID.pem \
-       --out ISI_manageof_Maryann__John_attr.der
-
-#[keyid:USC].role:employee <- [keyid:ISI].role:employee
-# Credential 4
-creddy --attribute \
-       --issuer USC_ID.pem --key USC_private.pem --role employee \
-       --subject-cert ISI_ID.pem --subject-role employee \
-       --out USC_employee__ISI_employee_attr.der
-
-#[keyid:ISI].role:employee  <- [keyid:Maryann]
-# Credential 5
-creddy --attribute \
-       --issuer ISI_ID.pem --key ISI_private.pem --role employee \
-       --subject-cert Maryann_ID.pem \
-       --out ISI_employee__Maryann_attr.der
-
-#[keyid:ISI].role:employee <- [keyid:John]
-# Credential 6
-creddy --attribute \
-       --issuer ISI_ID.pem --key ISI_private.pem --role employee \
-       --subject-cert John_ID.pem \
-       --out ISI_employee__John_attr.der
-
Index: examples/python_tests/evaluator_rt1/attr.py
===================================================================
--- examples/python_tests/evaluator_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/evaluator_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,6 @@
 
 """
-  to test with python
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
@@ -10,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -29,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 isiID=ABAC.ID("ISI_ID.pem")
 isiID.id_load_privkey_file("ISI_private.pem");
@@ -64,4 +68,5 @@
 
 #################################################
+# Credential 1, double uninstantiated parameters
 # [keyid:USC].role:managerOf([principal:?K])
 #            <-[keyid:ISI].role:managerOf([principal:?K])
@@ -70,10 +75,18 @@
 head = ABAC.Role(usc,"managerOf")
 head.role_add_data_term(param)
+
+# create variable princpal parameter
 param=ABAC.DataTerm("principal", "K")
 tail = ABAC.Role(isi,"managerOf")
 tail.role_add_data_term(param)
 attr=ABAC.Attribute(head, 1800)
+
+# compose the attribute for the policy
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# write the policy to a file
 attr.attribute_write_cert("USC_managerof_qK__USC_employee_attr.der")
 ctxt.load_attribute_file("USC_managerof_qK__USC_employee_attr.der")
@@ -83,4 +96,5 @@
 
 #################################################
+# Credential 2
 # [keyid:ISI].role:managerOf([keyid:Maryann]) 
 #                        <- [keyid:John]
@@ -99,4 +113,5 @@
 
 ################################################
+# Credential 3
 # [keyid:USC].role:employee <- [keyid:ISI].role:employee
 head=ABAC.Role(usc,"employee")
@@ -106,12 +121,12 @@
 attr.attribute_bake()
 attr.attribute_write_cert("USC_employee__ISI_employee_attr.der")
-#ctxt.load_attribute_file("USC_employee__ISI_employee_attr.der")
 ctxt.load_attribute(attr)
-#print attr.string() 
-#print attr.typed_string()
-#print "\n"
+print attr.string() 
+print attr.typed_string()
+print "\n"
 
 
 #################################################
+# Credential 4
 # [keyid:ISI].role:employee  <- [keyid:Maryann]
 head = ABAC.Role(isi,"employee")
@@ -121,5 +136,4 @@
 attr.attribute_bake()
 attr.attribute_write_cert("ISI_employee__Maryann_attr.der")
-#ctxt.load_attribute_file("ISI_employee__Maryann_attr.der")
 ctxt.load_attribute(attr)
 print attr.string() 
@@ -128,4 +142,5 @@
 
 #################################################
+# Credential 4
 # [keyid:ISI].role:employee  <- [keyid:John]
 head = ABAC.Role(isi,"employee")
@@ -135,5 +150,4 @@
 attr.attribute_bake()
 attr.attribute_write_cert("ISI_employee__John_attr.der")
-#ctxt.load_attribute_file("ISI_employee__John_attr.der")
 ctxt.load_attribute(attr)
 print attr.string() 
@@ -141,4 +155,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/evaluator_rt1/evaluator.save
===================================================================
--- examples/python_tests/evaluator_rt1/evaluator.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/evaluator_rt1/evaluator.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,17 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pISI,keyid,y) 
+(pJohn,keyid,y) 
+(pMaryann,keyid,y) 
+(pUSC,keyid,y) 
+
+...final policy attribute set...
+pISI.employee <- pJohn
+pISI.employee <- pMaryann
+pISI.managerOf(pMaryann) <- pJohn
+pUSC.employee <- pISI.employee
+pUSC.evaluatorOf(K) <- pUSC.managerOf(K)
+pUSC.managerOf(K) <- pISI.managerOf(K)
 
 ===good============ USC.evaluatorOf(Maryann) <- John
@@ -16,20 +30,2 @@
 pUSC.employee <- pISI.employee
 pISI.employee <- pJohn
-
-...final principal set...
-(pISI,keyid,y) 
-(pJohn,keyid,y) 
-(pMaryann,keyid,y) 
-(pUSC,keyid,y) 
-
-
-
-...final policy attribute set...
-pISI.employee <- pJohn
-pISI.employee <- pMaryann
-pISI.managerOf(pMaryann) <- pJohn
-pUSC.employee <- pISI.employee
-pUSC.evaluatorOf(K) <- pUSC.managerOf(K)
-pUSC.managerOf(K) <- pISI.managerOf(K)
-
-
Index: examples/python_tests/evaluator_rt1/query.py
===================================================================
--- examples/python_tests/evaluator_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/evaluator_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 isiID=ABAC.ID("ISI_ID.pem")
 isiID.id_load_privkey_file("ISI_private.pem");
@@ -37,4 +41,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is john an evaluator of maryann ?
 #role=[keyid:USC].role:evaluatorOf([keyid:Maryann])
 #p=[keyid:John]
@@ -49,4 +66,5 @@
 
 ##########################################################################
+# is john a manager of maryann ?
 #role=[keyid:USC].role:managerOf([keyid:Maryann])
 #p=[keyid:John]
@@ -61,4 +79,5 @@
 
 ##########################################################################
+# is john an employee of usc ?
 # role=[keyid:USC].role:employee 
 # p=[keyid:John]"
@@ -69,18 +88,2 @@
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
-
-
-##########################################################################
-# dump the loaded principals/policies 
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
Index: examples/python_tests/evaluator_rt1/run_test
===================================================================
--- examples/python_tests/evaluator_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/evaluator_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,7 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
-
 
 echo '---setup principals'
Index: examples/python_tests/evaluator_rt1/setup.py
===================================================================
--- examples/python_tests/evaluator_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/evaluator_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  to test with python
-
-
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
Index: examples/python_tests/experiment_create_rt0/README
===================================================================
--- examples/python_tests/experiment_create_rt0/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/experiment_create_rt0/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,2 @@
-#!/bin/sh
-#
 #
 #Acme runs a testbed. They've delegated the authority to create
@@ -18,47 +16,28 @@
 #    Alice.power_user <- Bob
 #
-#From these credentials, it is possible to construct a proof graph
-#showing that Acme.experiment_create <- Bob.
+#From these credentials, it is possible to show that 
+#    Acme.experiment_create <- Bob.
 #
-#Note that there is a one-to-one correspondence with each credential
-#above and the attribute certificates below.
+#In query.py, it checks if Alice is a admin of Globotron which is true;
+#and if Bob is an admin of Globotron which is not true; and also show
+# that Bob can create experiment at Acme
 #
+# experiment_create_rt0 
 
-# experiment_create_rt0_typed 
+# Credential 1
+#[keyid:Acme].role:experiment_create 
+#                 <- [keyid:Acme].role:partner.role:experiment_create
 
-creddy --generate --cn Acme
-creddy --generate --cn Globotron
-creddy --generate --cn Alice
-creddy --generate --cn Bob
+# Credential 2
+#[keyid:Acme].role:partner <- [keyid:Globotron]
 
-#[keyid:Acme].role:experiment_create <- [keyid:Acme].role:partner.role:experiment_create
-creddy --attribute \
-       --issuer Acme_ID.pem --key Acme_private.pem --role experiment_create \
-       --subject-cert Acme_ID.pem --subject-role partner.experiment_create \
-       --out Acme_experiment_create__Acme_partner_experiment_create_attr.der
+# Credential 3
+#[keyid:Globotron].role:expriment_create 
+                 <- [keyid:Globotron].role:admin.role:power_user
 
-#[keyid:Acme].role:partner <- [keyid:Globotron]
-creddy --attribute \
-       --issuer Acme_ID.pem --key Acme_private.pem --role partner \
-       --subject-cert Globotron_ID.pem \
-       --out Acme_partner__Globotron_attr.der 
+# Credential 4
+#[keyid:Globotron].role:admin <- [keyid:Alice]
 
-#[keyid:Globotron].role:expriment_create <- [keyid:Globotron].role:admin.role:power_user
-creddy --attribute \
-       --issuer Globotron_ID.pem --key Globotron_private.pem --role experiment_create \
-       --subject-cert Globotron_ID.pem --subject-role admin.power_user \
-       --out Globotron_experiment_create__Globotron_admin_power_user_attr.der
+# Credential 5
+#[keyid:Alice].role:power_user <- [keyid:Bob]
 
-#[keyid:Globotron].role:admin <- [keyid:Alice]
-creddy --attribute \
-       --issuer Globotron_ID.pem --key Globotron_private.pem --role admin \
-       --subject-cert Alice_ID.pem \
-       --out Globotron_admin__Alice_attr.der
-
-#[keyid:Alice].role:power_user <- [keyid:Bob]
-creddy --attribute \
-       --issuer Alice_ID.pem --key Alice_private.pem --role power_user \
-       --subject-cert Bob_ID.pem \
-       --out Alice_power_user__Bob_attr.der
-
-
Index: examples/python_tests/experiment_create_rt0/attr.py
===================================================================
--- examples/python_tests/experiment_create_rt0/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/experiment_create_rt0/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,6 @@
 
 """
-  to test with python
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
@@ -10,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -29,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 acmeID=ABAC.ID("Acme_ID.pem");
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -46,12 +50,24 @@
 
 ################################################
+# Credential 1, Anyone who is allowed to create experiment by Acme's
+#               partners can create experiment at Acme
 # [keyid:Acme].role:experiment_create 
 #           <- [keyid:Acme].role:partner.role:experiment_create
 head=ABAC.Role(acme,"experiment_create")
+
+# creating a linking role
 tail = ABAC.Role(acme,"partner","experiment_create")
+
+# compose the policy attribute
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# write out the policy to an external file
 attr.attribute_write_cert("Acme_experiment_create__Acme_partner_experiment_create_attr.der")
+
+# load the policy into the context by accessing that external file
 ctxt.load_attribute_file("Acme_experiment_create__Acme_partner_experiment_create_attr.der")
 print attr.string() 
@@ -60,4 +76,5 @@
 
 #################################################
+# Credential 2
 # [keyid:Acme].role:partner <- [keyid:Globotron]
 #
@@ -74,7 +91,10 @@
 
 #################################################
+# Credential 3
 # [keyid:Globotron].role:expriment_create 
 #           <- [keyid:Globotron].role:admin.role:power_user
 head = ABAC.Role(acme,"experiment_create")
+
+# a linking role
 tail = ABAC.Role(globotron,"admin","power_user")
 attr=ABAC.Attribute(head, 1800)
@@ -88,6 +108,9 @@
 
 #################################################
+# Credential 4, named term at the right
 # [keyid:Globotron].role:admin <- [keyid:Alice]
 head = ABAC.Role(globotron,"admin")
+
+# the named role is using keyid of alice
 tail = ABAC.Role(alice)
 attr=ABAC.Attribute(head, 1800)
@@ -113,4 +136,2 @@
 print "\n"
 
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/experiment_create_rt0/experiment.save
===================================================================
--- examples/python_tests/experiment_create_rt0/experiment.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/experiment_create_rt0/experiment.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,16 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAcme,keyid,y) 
+(pAlice,keyid,y) 
+(pBob,keyid,y) 
+(pGlobotron,keyid,y) 
+
+...final policy attribute set...
+pAcme.experiment_create <- pAcme.partner.experiment_create
+pAcme.partner <- pGlobotron
+pAlice.power_user <- pBob
+pGlobotron.admin <- pAlice
+pAcme.experiment_create <- pGlobotron.admin.power_user
 
 ===good=============== Globotron.admin <- Alice
@@ -13,19 +26,2 @@
 pGlobotron.admin <- pAlice
 pAlice.power_user <- pBob
-
-...final principal set...
-(pAcme,keyid,y) 
-(pAlice,keyid,y) 
-(pBob,keyid,y) 
-(pGlobotron,keyid,y) 
-
-
-
-...final policy attribute set...
-pAcme.experiment_create <- pAcme.partner.experiment_create
-pAcme.partner <- pGlobotron
-pAlice.power_user <- pBob
-pGlobotron.admin <- pAlice
-pAcme.experiment_create <- pGlobotron.admin.power_user
-
-
Index: examples/python_tests/experiment_create_rt0/query.py
===================================================================
--- examples/python_tests/experiment_create_rt0/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/experiment_create_rt0/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 acmeID=ABAC.ID("Acme_ID.pem");
 acmeID.id_load_privkey_file("Acme_private.pem");
@@ -37,4 +41,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is alice a admin at Globotron ?
 # role=[keyid:Globotron].role:admin 
 # p=[keyid:Alice]
@@ -47,4 +64,5 @@
 
 ##########################################################################
+# is bob a admin at Globotron ?
 # role=[keyid:Globotron].role:admin 
 # p=[keyid:Bob]
@@ -58,4 +76,5 @@
 
 ##########################################################################
+# can bob create experiment at Acme ?
 # role=[keyid:Acme].role:experiment_create 
 # p=[keyid:Bob]
@@ -66,19 +85,2 @@
 for c in out[1]:
     print "%s <- %s" % (c.head_string(), c.tail_string())
-
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
Index: examples/python_tests/experiment_create_rt0/run_test
===================================================================
--- examples/python_tests/experiment_create_rt0/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/experiment_create_rt0/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,7 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
-
 
 echo '---setup principals'
Index: examples/python_tests/experiment_create_rt0/setup.py
===================================================================
--- examples/python_tests/experiment_create_rt0/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/experiment_create_rt0/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  to test with python
-
-
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
Index: examples/python_tests/file_read_rt2/README
===================================================================
--- examples/python_tests/file_read_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/file_read_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,10 +1,6 @@
-#!/bin/sh
-#
 #####################################################################
-# This example demonstrates using a parameters to control access to files based
-# on the attributes of the principals.  The script creates three principals
-# Alpha, Bob, Maryann and Joe and sets out the access policy.
-# 
-# files are named by URNs and are not principals.
+# This example demonstrates using a parameters to control access to 
+# files based on the attributes of the principals. files are named by 
+# URNs and are not principals.
 # 
 # A principal's access rights are controlled by the Alpha principal.  If a
@@ -13,84 +9,24 @@
 # a file can read it. (Presumably the owner can, too, but that is not encoded
 # here.)
+#
+# The setup.py file creates four principals Alpha, Bob, Maryann and Joe
 # 
-# The example below lays out the policy that the manager of the owner of a file
+# The attr.py file lays out the policy that the manager of the owner of a file
 # can read it in Credential 1. Credential 2 establishes Bob as the manager of
 # Joe. and Credential 3 establishes Joe as the owner of the file.
 #
-# The attached ./run_query file runs 2 queries.  First it confirms that Bob can read
+# The query.py file runs 2 queries.  First it confirms that Bob can read
 # fileA, then it confirms that Maryann cannot. 
 
-# file_read_rt2_typed
-
-# alpha.read(fileA) <-?- Bob
-#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Bob] (yes)
-#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Maryann] (yes)
-
-creddy --generate --cn Alpha
-creddy --generate --cn Bob
-creddy --generate --cn Maryann
-creddy --generate --cn Joe
-
-alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
-bob_keyid=`creddy --keyid --cert Bob_ID.pem`
-maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
-joe_keyid=`creddy --keyid --cert Joe_ID.pem`
-
-read_fileA="read([urn:'file://fileA'])"
-managerof_joe="managerOf([keyid:$joe_keyid])"
-ownerof_fileA="ownerOf([urn:'file://fileA'])"
-managerof_qE="managerOf([principal:?E[keyid:$alpha_keyid].role:ownerOf([urn:?F])])"
-
-# alpha.read(?F) <- alpha.managerOf(?E:alpha.ownerOf(?F))
+# file_read_rt2
+#
+# Credential 1 (alpha.read(?F) <- alpha.managerOf(?E:alpha.ownerOf(?F)))
 # [keyid:alpha].role:read([urn:?F])<-
 #    [keyid:alpha].role:managerOf([principal:?E[keyid:alpha].role:ownerOf([urn:?F])]
-# Credential 1
-creddy --attribute \
-       --issuer Alpha_ID.pem --key Alpha_private.pem --role "read([urn:?F])" \
-       --subject-cert Alpha_ID.pem --subject-role "$managerof_qE" \
-       --out Alpha_read_qF__alpha_managerof_qE_attr.der
 
 # Credential 2
 #[keyid:Alpha].role:managerOf([Keyid:Joe]) <- [keyid:Bob]
-creddy --attribute \
-        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$managerof_joe" \
-        --subject-cert Bob_ID.pem \
-        --out Alpha_managerof_Joe__Bob_attr.der
 
 # Credential 3
 #[keyid:Alpha].role:ownerOf([urn:'file://fileA']) <- [keyid:Joe]
-creddy --attribute \
-        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$ownerof_fileA" \
-        --subject-cert Joe_ID.pem \
-        --out Alpha_ownerof_fileA__Joe_attr.der
 
-####################################################################################
-# note:
-# 
-# alpha.read(?F) <- alpha.manager(?E:alpha.owner(?F))
-# [keyid:alpha].role:read([urn:?F])<-
-#       #[keyid:alpha].role:manager([principal:?E[keyid:alpha].role:owner([urn:?F])])
-# 
-# alpha.read(?F) <- alpha.manager(?E) 
-# and alpha.owner(?F) <- ?E
-# 
-# [keyid:alpha].role:read([urn:?F])<-[keyid:?M]
-#     [keyid:alpha].role:manager([principal:?E])<-[keyid:?M]
-#     [keyid:alpha].role:owner([urn:?F])<-[keyid:?E]
-# 
-# isMember(M,role(alpha,read,F)) :-
-#       isMember(M, role(alpha,manager,E)),
-#       isMember(E, role(alpha,owner,F))  <-- constraining rule
-# 
-# alpha.read(?F) <- alpha.manager(?E)
-# alpha.owner(?F) <- ?E
-# 
-# condition like this,
-#          ?E:A.r  needs to be translate into constraining rule,  A.r<-?E
-# 
-# query,
-# alpha.read(fileA) <-?- Bob
-# needs
-# alpha.manager(Joe)<-Bob
-# alpha.owner(fileA)<-Joe
-
Index: examples/python_tests/file_read_rt2/attr.py
===================================================================
--- examples/python_tests/file_read_rt2/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/file_read_rt2/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,6 @@
 
 """
-  to test with python
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
@@ -10,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -29,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 alphaID=ABAC.ID("Alpha_ID.pem")
 alphaID.id_load_privkey_file("Alpha_private.pem");
@@ -47,4 +51,6 @@
 
 ################################################
+# Credential 1, demostrates role constraint on a file, 
+#               manager of the owner of a file can also read that file
 # [keyid:alpha].role:read([urn:?F])<-
 #    [keyid:alpha].role:managerOf([principal:?E[keyid:alpha].role:ownerOf([urn:?F])]
@@ -52,14 +58,28 @@
 head = ABAC.Role(alpha,"read")
 head.role_add_data_term(param)
+
+# create variable data term
 param=ABAC.DataTerm("urn", "F")
-condoset=ABAC.Role(alpha,"ownerOf")
-condoset.role_add_data_term(param)
-cond=ABAC.Constraint(condoset)
+
+# create the constraining role structure
+condrole=ABAC.Role(alpha,"ownerOf")
+condrole.role_add_data_term(param)
+
+# create the constraint
+cond=ABAC.Constraint(condrole)
+
+# build the parameter with constraint
 param=ABAC.DataTerm("principal", "E", cond)
 tail = ABAC.Role(alpha,"managerOf")
 tail.role_add_data_term(param)
+
+# compose attribute policy
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# write out to external file
 attr.attribute_write_cert("Alpha_read_qF__alpha_managerof_qE_attr.der")
 ctxt.load_attribute_file("Alpha_read_qF__alpha_managerof_qE_attr.der")
@@ -69,4 +89,5 @@
 
 #################################################
+# Credential 2, Bob is Joe's manager
 # [keyid:Alpha].role:managerOf([Keyid:Joe]) <- [keyid:Bob]
 #
@@ -85,4 +106,5 @@
 
 #################################################
+# Credential 3, Joe is file's owner
 #[keyid:Alpha].role:ownerOf([urn:'file://fileA']) <- [keyid:Joe]
 #
@@ -100,5 +122,2 @@
 print "\n"
 
-
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/file_read_rt2/file.save
===================================================================
--- examples/python_tests/file_read_rt2/file.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/file_read_rt2/file.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,14 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAlpha,keyid,y) 
+(pBob,keyid,y) 
+(pJoe,keyid,y) 
+(pMaryann,keyid,y) 
+
+...final policy attribute set...
+pAlpha.managerOf(pJoe) <- pBob
+pAlpha.ownerOf('file://fileA') <- pJoe
+pAlpha.read(F) <- pAlpha.managerOf(E:pAlpha.ownerOf(F))
 
 ===good============ alpha.read(fileA) <- Bob
@@ -9,17 +20,2 @@
 ===bad============ alpha.read(fileA) <- Maryann
 YAP query failed
-
-...final principal set...
-(pAlpha,keyid,y) 
-(pBob,keyid,y) 
-(pJoe,keyid,y) 
-(pMaryann,keyid,y) 
-
-
-
-...final policy attribute set...
-pAlpha.managerOf(pJoe) <- pBob
-pAlpha.ownerOf('file://fileA') <- pJoe
-pAlpha.read(F) <- pAlpha.managerOf(E:pAlpha.ownerOf(F))
-
-
Index: examples/python_tests/file_read_rt2/query.py
===================================================================
--- examples/python_tests/file_read_rt2/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/file_read_rt2/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 alphaID=ABAC.ID("Alpha_ID.pem")
 alphaID.id_load_privkey_file("Alpha_private.pem");
@@ -37,4 +41,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# can Bob read fileA ?
 # role=[keyid:Alpha].role:read([urn:'file://fileA']) 
 # p=[keyid:Bob]
@@ -49,4 +66,5 @@
 
 ##########################################################################
+# can Maryann read fileA ?
 # role=[keyid:Alpha].role:read([urn:'file://fileA']) 
 # p=[keyid:Maryann]
@@ -59,17 +77,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-##########################################################################
-# dump the loaded principals/policies 
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
Index: examples/python_tests/file_read_rt2/run_test
===================================================================
--- examples/python_tests/file_read_rt2/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/file_read_rt2/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,7 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
-
 
 echo '---setup principals'
Index: examples/python_tests/file_read_rt2/setup.py
===================================================================
--- examples/python_tests/file_read_rt2/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/file_read_rt2/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  to test with python
-
-
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
Index: examples/python_tests/fruits_rt2/README
===================================================================
--- examples/python_tests/fruits_rt2/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/fruits_rt2/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,2 @@
-#!/bin/sh
 #
 # This demonstrates assigning objects to object sets (osets) based on their
@@ -9,5 +8,5 @@
 # Credential 1 lays out Mary's policy - she will eat fruits that cost less that
 # or equal to 2.00.  Bob will eat fruits that cost between 1.00 and 5.00, as
-# laid out in Credential 2.  Strictly speaking Bob and Mary's ruls apply to
+# laid out in Credential 2.  Strictly speaking Bob and Mary's rules apply to
 # prices assigned by Ralphs.  Credentials 3-6 are Ralph's price assignments:
 # 
@@ -15,97 +14,32 @@
 # apple               1.50       3
 # kiwi                1.50       4
-# black rsaberry      2.50       5
+# black rasberry      2.50       5
 # navel ornage        0.50       6
 #
-# The attached ./run_query file proves that Mary will eat a naval orange and a kiwi,
+# The query.py file proves that Mary will eat a naval orange and a kiwi,
 # and that Bob will not eat a navel orange (too cheap).  It also proves a apple
 # is priced at 1.50 and that it cannot prove that a green apple is priced at
 # 1.50 (we don't know anything about green apples).
 
-# fruits_rt2_typed
+# fruits_rt2
 
-# mary.what2eat<-?-navel orange  good
-# mary.what2eat<-?-kiwi  good
-# bob.what2eat<-?-navel orange  bad
-# ralphs.fruitprice(1.50)<-?-apple   good
-# ralphs.fruitprice(1.50)<-?-green apple   bad
-
-creddy --generate --cn Mary
-creddy --generate --cn Bob
-creddy --generate --cn Ralphs
-
-mary_keyid=`creddy --keyid --cert Mary_ID.pem`
-bob_keyid=`creddy --keyid --cert Bob_ID.pem`
-ralphs_keyid=`creddy --keyid --cert Ralphs_ID.pem`
-
-fruitprice_qP="fruitprice([float:?P:[..2.00]])"
-fruitprice_qP_2="fruitprice([float:?P:[1.00..5.00]])"
-
+# Credential 1
 # [keyid:mary].oset:what2eat 
 #      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
-# Credential 1
-creddy --attribute \
-       --issuer Mary_ID.pem --key Mary_private.pem --oset "what2eat" \
-       --subject-cert Ralphs_ID.pem --subject-oset "$fruitprice_qP" \
-       --out mary_what2eat__ralphs_fruitprice_qP_attr.der
 
+# Credential 2
 # [keyid:bob].oset:what2eat 
 #      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
-# Credential 2
-creddy --attribute \
-       --issuer Bob_ID.pem --key Bob_private.pem --oset "what2eat" \
-       --subject-cert Ralphs_ID.pem --subject-oset "$fruitprice_qP_2" \
-       --out bob_what2eat__ralphs_fruitprice_qP_2_attr.der
 
+# Credential 3
 # [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
-# Credential 3
-creddy --attribute \
-        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
-        --oset "fruitprice([float:1.50])" \
-        --subject-obj "[string:'apple']" \
-        --out Ralphs_fruitprice__apple_attr.der
 
+# Credential 4
 # [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'kiwi']
-# Credential 4
-creddy --attribute \
-        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
-        --oset "fruitprice([float:1.50])" \
-        --subject-obj "[string:'kiwi']" \
-        --out Ralphs_fruitprice__kiwi_attr.der
 
+# Credential 5
+# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black rasberry']
 
-# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black rasberry']
-# Credential 5
-creddy --attribute \
-        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
-        --oset "fruitprice([float:2.50])" \
-        --subject-obj "[string:'black rasberry']" \
-        --out Ralphs_fruitprice__black_rasberry_attr.der
+# Credential 6
+# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
 
-# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
-# Credential 6
-creddy --attribute \
-        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
-        --oset "fruitprice([float:0.50])" \
-        --subject-obj "[string:'navel orange']" \
-        --out Ralphs_fruitprice__navel_orange_attr.der
-
-#####################################################################
-# mary.what2eat <- ralphs.fruitsprice(?P:[..2.00])
-# [keyid:mary].oset:what2eat 
-#      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
-#
-# bob.what2eat <- ralphs.fruitsprice(?P:[1.00..5.00])
-# [keyid:bob].oset:what2eat 
-#      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
-# 
-# ralphs.fruitprice(1.50)<-apple
-# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
-#
-# ralphs.fruitprice(2.50)<-black rasberry
-# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black rasberry']
-#
-# ralphs.fruitprice(0.50)<-navel orange
-# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
-# 
-
Index: examples/python_tests/fruits_rt2/attr.py
===================================================================
--- examples/python_tests/fruits_rt2/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/fruits_rt2/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,4 +2,7 @@
 
 """
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
 cmd1:env keystore=`pwd` ./attr.py 
 """
@@ -8,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -27,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 ralphsID=ABAC.ID("Ralphs_ID.pem");
 ralphsID.id_load_privkey_file("Ralphs_private.pem");
@@ -40,17 +46,32 @@
 
 ################################################
+# Credential 1, what kind of fruit Mary would eat. Anything not costing more
+#               than 2 dollars
 # [keyid:mary].oset:what2eat
 #      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
-# [keyid:alpha].role:access([string:'Read'],[urn:'file//fileB']) <- [keyid:bob]
 head = ABAC.Oset(mary,"what2eat")
+
+# initialize a float range constraint
 cond=ABAC.Constraint("float")
+
+# add the upper max to the range, and only the max
 cond.constraint_add_float_max(2.00)
+
+# create the data term with the constraint
 param=ABAC.DataTerm("float", "P", cond)
 tail = ABAC.Oset(ralphs,"fruitprice")
 tail.oset_add_data_term(param)
+
+# compose the attribute policy
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+#finalize the policy
 attr.attribute_bake()
+
+#write out the policy to a credential file
 attr.attribute_write_cert("mary_what2eat__ralphs_fruitprice_qP_attr.der")
+
+# load the rule back into context via credential file
 ctxt.load_attribute_file("mary_what2eat__ralphs_fruitprice_qP_attr.der")
 print attr.string() 
@@ -59,16 +80,24 @@
 
 ################################################
+# Credential 2,
 # [keyid:bob].oset:what2eat
 #      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
 head = ABAC.Oset(bob,"what2eat")
+
+# initialze a float range constraint
 cond=ABAC.Constraint("float")
+
+# add the min and max value to the range
 cond.constraint_add_float_min(1.00)
 cond.constraint_add_float_max(5.00)
-print cond.typed_string()
 param=ABAC.DataTerm("float", "P", cond)
 tail = ABAC.Oset(ralphs,"fruitprice")
 tail.oset_add_data_term(param)
+
+#create attribute policy
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+#finalize the policy
 attr.attribute_bake()
 attr.attribute_write_cert("bob_what2eat__ralphs_fruitprice_qP_attr.der")
@@ -79,4 +108,5 @@
 
 #################################################
+# Credential 3
 # [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
 param=ABAC.DataTerm("float", "1.50")
@@ -95,4 +125,5 @@
 
 #################################################
+# Credential 4
 # [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'kiwi']
 param=ABAC.DataTerm("float", "1.50")
@@ -111,4 +142,5 @@
 
 #################################################
+# Credential 5
 # [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black berry']
 param=ABAC.DataTerm("float", "2.50")
@@ -127,4 +159,5 @@
 
 #################################################
+# Credential 6
 # [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
 param=ABAC.DataTerm("float", "0.50")
@@ -142,5 +175,2 @@
 print "\n"
 
-##
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/fruits_rt2/fruit.save
===================================================================
--- examples/python_tests/fruits_rt2/fruit.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/fruits_rt2/fruit.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,4 +1,17 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
    
+...final principal set...
+(pBob,keyid,y) 
+(pMary,keyid,y) 
+(pRalphs,keyid,y) 
+
+...final policy attribute set...
+pRalphs.fruitprice(1.50) <- 'apple'
+pRalphs.fruitprice(2.50) <- 'black berry'
+pRalphs.fruitprice(1.50) <- 'kiwi'
+pRalphs.fruitprice(0.50) <- 'navel orange'
+pBob.what2eat <- pRalphs.fruitprice(P:[1.000000 .. 5.000000])
+pMary.what2eat <- pRalphs.fruitprice(P:[.. 2.000000])
+
 ===good============ mary.what2eat <- navel orange
 YAP query succeed
@@ -20,19 +33,2 @@
 ===bad============ ralphs.fruitprice(1.50) <- green apple
 YAP query failed
-
-...final principal set...
-(pBob,keyid,y) 
-(pMary,keyid,y) 
-(pRalphs,keyid,y) 
-
-
-
-...final policy attribute set...
-pRalphs.fruitprice(1.50) <- 'apple'
-pRalphs.fruitprice(2.50) <- 'black berry'
-pRalphs.fruitprice(1.50) <- 'kiwi'
-pRalphs.fruitprice(0.50) <- 'navel orange'
-pBob.what2eat <- pRalphs.fruitprice(P:[1.000000 .. 5.000000])
-pMary.what2eat <- pRalphs.fruitprice(P:[.. 2.000000])
-
-
Index: examples/python_tests/fruits_rt2/query.py
===================================================================
--- examples/python_tests/fruits_rt2/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/fruits_rt2/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 ralphsID=ABAC.ID("Ralphs_ID.pem");
 ralphsID.id_load_privkey_file("Ralphs_private.pem");
@@ -33,4 +37,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# Would Mary eat navel orange ?
 # oset = [keyid:mary].oset:what2eat 
 # p [string:'navel orange'] 
@@ -45,4 +62,5 @@
 
 ##########################################################################
+# Would Mary eat kiwi ?
 # oset = [keyid:mary].oset:what2eat 
 # p [string:'kiwi'] 
@@ -57,4 +75,5 @@
 
 ##########################################################################
+# Would Bob eat navel orange ?
 # oset = [keyid:bob].oset:what2eat 
 # p [string:'navel orange'] 
@@ -69,4 +88,5 @@
 
 ##########################################################################
+# Is Apple 1.50 at Ralphs ?
 # oset = [keyid:$ralphs].oset:fruitprice([float:1.50]) 
 # p = [string:'apple'] 
@@ -83,4 +103,5 @@
 
 ##########################################################################
+# Is green apple 1.50 at Ralphs ?
 # oset = [keyid:$ralphs].oset:fruitprice([float:1.50]) 
 # p = [string:'green apple'] 
@@ -101,18 +122,2 @@
 #ctxt.dump_yap_db()
 
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
-
Index: examples/python_tests/fruits_rt2/run_test
===================================================================
--- examples/python_tests/fruits_rt2/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/fruits_rt2/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/fruits_rt2/setup.py
===================================================================
--- examples/python_tests/fruits_rt2/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/fruits_rt2/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,4 +2,6 @@
 
 """
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
Index: examples/python_tests/leader_rt1/README
===================================================================
--- examples/python_tests/leader_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/leader_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,2 @@
-#!/bin/sh
 #
 # This example shows a way to allow an user with multiple keyid identities 
@@ -13,56 +12,22 @@
 # credential 3 and 4 are the equivalent rules between Bob and Joe.
 #
-# The attached ./run_query file asks if Joe is also an group leader which
-# he is because there is a equivalent rule from Bob to him. It also asks
-# if Jack is a group leader which he isn't because there is no equivalent
-# rule from Bob to him.
+# The query.py file asks if Joe is also an group leader which he is because
+# there is a equivalent rule from Bob to him. It also asks  if Jack is a 
+# group leader which he isn't because there is no equivalent rule from Bob 
+# to him.
 
-# leader_rt1_typed
+# leader_rt1
 
-# [keyid:geni].role:leader <-?- [keyid:Bob] (yes)
-# [keyid:geni].role:leader <-?- [keyid:Jack] (no)
-# [keyid:geni].role:leader <-?- [keyid:Joe] (yes)
-
-creddy --generate --cn Geni
-creddy --generate --cn Bob
-creddy --generate --cn Jack
-creddy --generate --cn Joe
-
-geni_keyid=`creddy --keyid --cert Geni_ID.pem`
-bob_keyid=`creddy --keyid --cert Bob_ID.pem`
-jack_keyid=`creddy --keyid --cert Jack_ID.pem`
-joe_keyid=`creddy --keyid --cert Joe_ID.pem`
-
-leader_qP="equivalent([principal:?P[keyid:$geni_keyid].role:leader])"
-equivalent_bob="equivalent([keyid:$bob_keyid])"
-equivalent_joe="equivalent([keyid:$joe_keyid])"
-
+# Credential 1,
 # [keyid:geni].role:leader 
 #         <- [keyid:geni].role:equivalent([principal:?P[keyid:geni].role:leader])
-# Credential 1
-/home/mei/Deter/abac/creddy/creddy --attribute \
-       --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
-       --subject-cert Geni_ID.pem --subject-role "$leader_qP" \
-       --out geni_leader__geni_leader_qP_attr.der
 
+# Credential 2
 # [keyid:geni].role:leader <- [keyid:bob]
-# Credential 2
-creddy --attribute \
-        --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
-        --subject-cert Bob_ID.pem \
-        --out geni_leader__Bob_attr.der
 
+# Credential 3
 # [keyid:geni].role:equivalent([keyid:bob]) <- [keyid:Joe]
-# Credential 3
-creddy --attribute \
-        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_bob" \
-        --subject-cert Joe_ID.pem \
-        --out geni_equivalent_Bob__Joe_attr.der
 
+# Credential 4
 # [keyid:geni].role:equivalent([keyid:Joe]) <- [keyid:Bob]
-# Credential 4
-creddy --attribute \
-        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_joe" \
-        --subject-cert Bob_ID.pem \
-        --out geni_equivalent_Joe__Bob_attr.der
 
Index: examples/python_tests/leader_rt1/attr.py
===================================================================
--- examples/python_tests/leader_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/leader_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,6 @@
 
 """
-  to test with python
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
@@ -10,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -29,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 geniID=ABAC.ID("Geni_ID.pem");
 geniID.id_load_privkey_file("Geni_private.pem");
@@ -46,16 +50,29 @@
 
 ################################################
+# Credential 1, 
 # [keyid:geni].role:leader
 #         <- [keyid:geni].role:equivalent([principal:?P[keyid:geni].role:leader])
 head=ABAC.Role(geni,"leader")
-condoset=ABAC.Role(geni,"leader")
-cond=ABAC.Constraint(condoset)
+
+# initialize the role constraint on a principlal
+condrole=ABAC.Role(geni,"leader")
+cond=ABAC.Constraint(condrole)
+
+# make the data term with the role constraint
 param=ABAC.DataTerm("principal","P", cond)
 tail = ABAC.Role(geni,"equivalent")
 tail.role_add_data_term(param)
+
+# build he attribute policy
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail)
+
+# finalize the policy
 attr.attribute_bake()
+
+# write the policy out to a credential file
 attr.attribute_write_cert("geni_leader__geni_leader_qP_attr.der")
+
+# load the policy into the context using the credential file
 ctxt.load_attribute_file("geni_leader__geni_leader_qP_attr.der")
 print attr.string() 
@@ -64,4 +81,5 @@
 
 #################################################
+# Credential 2
 # [keyid:geni].role:leader <- [keyid:bob]
 head=ABAC.Role(geni,"leader")
@@ -77,4 +95,5 @@
 
 #################################################
+# Credential 3
 # [keyid:geni].role:equivalent([keyid:bob]) <- [keyid:Joe]
 param=ABAC.DataTerm(bobID)
@@ -92,4 +111,5 @@
 
 #################################################
+# Credential 4
 # [keyid:geni].role:equivalent([keyid:Joe]) <- [keyid:Bob]
 param=ABAC.DataTerm(joeID)
@@ -105,47 +125,2 @@
 print attr.typed_string()
 print "\n"
-
-#################################################
-# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
-head = ABAC.Role(bob,"niceCoworker")
-tail = ABAC.Role(jack)
-attr=ABAC.Attribute(head, 1800)
-attr.attribute_add_tail(tail)
-attr.attribute_bake()
-attr.attribute_write_cert("Bob_nicecoworker__Maryann_attr.der")
-ctxt.load_attribute_file("Bob_nicecoworker__Maryann_attr.der")
-print attr.string() 
-print attr.typed_string()
-print "\n"
-
-#################################################
-# [keyid:geni].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
-param=ABAC.DataTerm(joeID)
-head = ABAC.Role(geni,"evaluatorOf")
-head.role_add_data_term(param)
-tail = ABAC.Role(bob)
-attr=ABAC.Attribute(head, 1800)
-attr.attribute_add_tail(tail)
-attr.attribute_bake()
-attr.attribute_write_cert("Alpha_evaluator_j__Bob_attr.der")
-ctxt.load_attribute_file("Alpha_evaluator_j__Bob_attr.der")
-print attr.string() 
-print attr.typed_string()
-print "\n"
-
-#################################################
-# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
-head = ABAC.Role(bob,"goodPerformance")
-tail = ABAC.Role(joe)
-attr=ABAC.Attribute(head, 1800)
-attr.attribute_add_tail(tail)
-attr.attribute_bake()
-attr.attribute_write_cert("Bob_goodperformance__Joe_attr.der")
-ctxt.load_attribute_file("Bob_goodperformance__Joe_attr.der")
-print attr.string() 
-print attr.typed_string()
-print "\n"
-
-
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/leader_rt1/leader.save
===================================================================
--- examples/python_tests/leader_rt1/leader.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/leader_rt1/leader.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,15 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pBob,keyid,y) 
+(pGeni,keyid,y) 
+(pJack,keyid,y) 
+(pJoe,keyid,y) 
+
+...final policy attribute set...
+pGeni.equivalent(pBob) <- pJoe
+pGeni.equivalent(pJoe) <- pBob
+pGeni.leader <- pBob
+pGeni.leader <- pGeni.equivalent(P:pGeni.leader)
 
 ===good============ geni.leader <- Bob
@@ -13,21 +25,2 @@
 pGeni.leader <- pBob
 pGeni.equivalent(pBob) <- pJoe
-
-...final principal set...
-(pBob,keyid,y) 
-(pGeni,keyid,y) 
-(pJack,keyid,y) 
-(pJoe,keyid,y) 
-
-
-
-...final policy attribute set...
-pGeni.evaluatorOf(pJoe) <- pBob
-pBob.goodPerformance <- pJoe
-pBob.niceCoworker <- pJack
-pGeni.equivalent(pBob) <- pJoe
-pGeni.equivalent(pJoe) <- pBob
-pGeni.leader <- pBob
-pGeni.leader <- pGeni.equivalent(P:pGeni.leader)
-
-
Index: examples/python_tests/leader_rt1/query.py
===================================================================
--- examples/python_tests/leader_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/leader_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 geniID=ABAC.ID("Geni_ID.pem");
 geniID.id_load_privkey_file("Geni_private.pem");
@@ -37,4 +41,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is Bob a leader at Geni ?
 # role=[keyid:geni].role:leader 
 # p=[keyid:Bob]
@@ -47,4 +64,5 @@
 
 ##########################################################################
+# is Jack a leader at Geni ?
 # role=[keyid:geni].role:leader 
 # p=[keyid:Jack]
@@ -57,4 +75,5 @@
 
 ##########################################################################
+# is Joe a leader at Geni ?
 # role=[keyid:geni].role:leader 
 # p=[keyid:Joe]
@@ -66,18 +85,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
Index: examples/python_tests/leader_rt1/run_test
===================================================================
--- examples/python_tests/leader_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/leader_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,6 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo '---setup principals'
Index: examples/python_tests/leader_rt1/setup.py
===================================================================
--- examples/python_tests/leader_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/leader_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  to test with python
-
-
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
Index: examples/python_tests/payraise_rt1/README
===================================================================
--- examples/python_tests/payraise_rt1/README	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/payraise_rt1/README	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,2 @@
-#!/bin/sh
 
 #####################################################################
@@ -18,108 +17,30 @@
 # performance. But, there is no fact that says Joe is a nice coworker.
 #
-# The attached ./run_query file asks if a given principal is
-# entitled to a pay raise. Maryann is but not Joe, because his manager
-# did not affirm his pleasantness(but neither did he deny it)
+# The query.py file asks if a given principal is entitled to a pay
+# raise. Maryann is but not Joe, because his manager did not affirm 
+# his pleasantness(but neither did he deny it)
 
-rm -rf *der *pem
-
-# [keyid:Alpha].role:payRaise <-?- [keyid:Maryann] (yes)
-# [keyid:Alpha].role:payRaise <-?- [keyid:Joe] (no)
-
-creddy --generate --cn Alpha
-creddy --generate --cn Bob
-creddy --generate --cn Maryann
-creddy --generate --cn Joe
-
-alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
-
-bob_keyid=`creddy --keyid --cert Bob_ID.pem`
-maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
-joe_keyid=`creddy --keyid --cert Joe_ID.pem`
-
-performance_qT="evaluatorOf([principal:?this]).goodPerformance"
-niceguy_qT="managerOf([principal:?this]).niceCoworker"
-
-manager_qZ="managerOf([principal:?Z])"
-evaluator_qZ="evaluatorOf([principal:?Z])"
-
-evaluator_m="evaluatorOf([keyid:$maryann_keyid])"
-evaluator_j="evaluatorOf([keyid:$joe_keyid])"
-
+# Credential 1,
 # [keyid:alpha].role:payRaise <-
 #           [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
 #           [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
-# Credential 1
-creddy --attribute \
-       --issuer Alpha_ID.pem --key Alpha_private.pem --role payRaise \
-       --subject-cert Alpha_ID.pem --subject-role "$performance_qT" \
-       --subject-cert Alpha_ID.pem --subject-role "$niceguy_qT" \
-       --out Alpha_payraise__Alpha_performance_qT_niceguy_qT_attr.der
 
+# Credential 2
 # [keyid:alpha].role:managerOf([principal:?Z])<-
 #           [keyid:alpha].role:evaluatorOf([principal:?Z])
-# Credential 2
-creddy --attribute \
-       --issuer Alpha_ID.pem --key Alpha_private.pem --role "$manager_qZ" \
-       --subject-cert Alpha_ID.pem --subject-role "$evaluator_qZ" \
-       --out Alpha_manager_qZ__Alpha_evaluator_qZ_attr.der
 
+# Credential 3
 # [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
-# Credential 3
-creddy --attribute \
-        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$evaluator_m" \
-        --subject-cert Bob_ID.pem \
-        --out Alpha_evaluator_m__Bob_attr.der
 
+# Credential 4 
 # [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
-# Credential 4 
-creddy --attribute \
-        --issuer Bob_ID.pem --key Bob_private.pem --role goodPerformance \
-        --subject-cert Maryann_ID.pem \
-        --out Bob_goodperformance__Maryann_attr.der
 
+# Credential 5 
 # [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
-# Credential 5 
-creddy --attribute \
-        --issuer Bob_ID.pem --key Bob_private.pem --role niceCoworker \
-        --subject-cert Maryann_ID.pem \
-        --out Bob_niceworker__Maryann_attr.der
 
+# Credential 6
 # [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
-# Credential 6
-creddy --attribute \
-        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$evaluator_j" \
-        --subject-cert Bob_ID.pem \
-        --out Alpha_evaluator_j__Bob_attr.der
 
+# Credential 7 
 # [keyid:Bob].role:goodPerformance <- [keyid:Joe])
-# Credential 7 
-creddy --attribute \
-        --issuer Bob_ID.pem --key Bob_private.pem --role goodPerformance \
-        --subject-cert Joe_ID.pem \
-        --out Bob_goodperformance__Joe_attr.der
 
-
-#####################################################################
-# 
-# alpha.payRaise <- alpha.evaluatorOf(this).goodPerformance & 
-#                   alpha.managerOf(this).niceCoworker
-# [keyid:alpha].role:payRaise <-
-#           [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
-#           [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
-#
-# alpha.managerOf(this) <- alpha.evaluatorOf(this)
-# [keyid:alpha].role:managerOf([principal:?this])<-
-#           [keyid:alpha].role:evaluatorOf([principal:?this])
-#
-# alpha.evaluatorOf(Maryann)<-Bob
-# [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
-# Bob.goodPerformance<-Maryann
-# [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
-# Bob.niceCoworker<-Maryann
-# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
-#
-# alpha.evaluatorOf(Joe)<-Bob
-# [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
-# Bob.goodPerformance<-Joe
-# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
Index: examples/python_tests/payraise_rt1/attr.py
===================================================================
--- examples/python_tests/payraise_rt1/attr.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/payraise_rt1/attr.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,6 @@
 
 """
-  to test with python
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
 
 cmd1:env keystore=`pwd` ./attr.py 
@@ -10,10 +11,12 @@
 import ABAC
 
-keystore=os.environ["keystore"]
-
 ctxt = ABAC.Context()
 print "ABAC version %s" % ctxt.version()
 
-ctxt.load_directory(keystore)
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
 
 out = ctxt.context_principals()
@@ -29,4 +32,5 @@
 print "\n"
 
+# retrieve principals' keyid value from local credential files
 alphaID=ABAC.ID("Alpha_ID.pem");
 alphaID.id_load_privkey_file("Alpha_private.pem");
@@ -46,18 +50,34 @@
 
 ################################################
+# Credential 1, intersecting linking roles with This principal param for the
+#               linked role
 # [keyid:alpha].role:payRaise <-
 #      [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
 #      [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
 head=ABAC.Role(alpha,"payRaise")
+
+# build a data term with ?This
 param=ABAC.DataTerm("principal", "This")
 tail1 = ABAC.Role(alpha,"evaluatorOf","goodPerformance")
+
+# add the param to the linked role
 tail1.role_add_linked_data_term(param)
+
+# build another data term with ?This
 param=ABAC.DataTerm("principal", "This")
 tail2 = ABAC.Role(alpha,"managerOf","niceCoworker")
+
+# add the param to the linked role
 tail2.role_add_linked_data_term(param)
+
+# compose the intersecting role attribute policy
 attr=ABAC.Attribute(head, 1800)
 attr.attribute_add_tail(tail1)
 attr.attribute_add_tail(tail2)
+
+# finalize the attribute policy
 attr.attribute_bake()
+
+# write out the attribute credential file
 attr.attribute_write_cert("Alpha_payraise__Alpha_performance_qT_niceguy_qT_attr.der")
 ctxt.load_attribute_file("Alpha_payraise__Alpha_performance_qT_niceguy_qT_attr.der")
@@ -67,4 +87,5 @@
 
 #################################################
+# Credential 2, 
 # [keyid:alpha].role:managerOf([principal:?Z])<-
 #           [keyid:alpha].role:evaluatorOf([principal:?Z])
@@ -85,4 +106,5 @@
 
 #################################################
+# Credential 3
 # [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
 param=ABAC.DataTerm(maryannID)
@@ -100,4 +122,5 @@
 
 #################################################
+# Credential 4
 # [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
 head = ABAC.Role(bob,"goodPerformance")
@@ -113,4 +136,5 @@
 
 #################################################
+# Credential 5
 # [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
 head = ABAC.Role(bob,"niceCoworker")
@@ -126,4 +150,5 @@
 
 #################################################
+# Credential 6
 # [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
 param=ABAC.DataTerm(joeID)
@@ -141,4 +166,5 @@
 
 #################################################
+# Credential 7
 # [keyid:Bob].role:goodPerformance <- [keyid:Joe])
 head = ABAC.Role(bob,"goodPerformance")
@@ -153,5 +179,2 @@
 print "\n"
 
-
-ctxt.dump_yap_db()
-##
Index: examples/python_tests/payraise_rt1/pay.save
===================================================================
--- examples/python_tests/payraise_rt1/pay.save	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/payraise_rt1/pay.save	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,3 +1,18 @@
 % Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAlpha,keyid,y) 
+(pBob,keyid,y) 
+(pJoe,keyid,y) 
+(pMaryann,keyid,y) 
+
+...final policy attribute set...
+pAlpha.evaluatorOf(pJoe) <- pBob
+pAlpha.evaluatorOf(pMaryann) <- pBob
+pAlpha.managerOf(Z) <- pAlpha.evaluatorOf(Z)
+pAlpha.payRaise <- pAlpha.evaluatorOf(This).goodPerformance & pAlpha.managerOf(This).niceCoworker
+pBob.goodPerformance <- pJoe
+pBob.goodPerformance <- pMaryann
+pBob.niceCoworker <- pMaryann
 
 ===bad============ alpha.payRaise <- Joe
@@ -11,21 +26,2 @@
 pAlpha.managerOf(Z) <- pAlpha.evaluatorOf(Z)
 pBob.niceCoworker <- pMaryann
-
-...final principal set...
-(pAlpha,keyid,y) 
-(pBob,keyid,y) 
-(pJoe,keyid,y) 
-(pMaryann,keyid,y) 
-
-
-
-...final policy attribute set...
-pAlpha.evaluatorOf(pJoe) <- pBob
-pAlpha.evaluatorOf(pMaryann) <- pBob
-pAlpha.managerOf(Z) <- pAlpha.evaluatorOf(Z)
-pAlpha.payRaise <- pAlpha.evaluatorOf(This).goodPerformance & pAlpha.managerOf(This).niceCoworker
-pBob.goodPerformance <- pJoe
-pBob.goodPerformance <- pMaryann
-pBob.niceCoworker <- pMaryann
-
-
Index: examples/python_tests/payraise_rt1/query.py
===================================================================
--- examples/python_tests/payraise_rt1/query.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/payraise_rt1/query.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,5 +2,5 @@
 
 """
-  to test with python
+Run the queries described in README
 
 cmd1:env keystore=`pwd` ./query.py 
@@ -14,10 +14,14 @@
 ctxt = ABAC.Context()
 
-# print "ABAC version %s" % ctxt.version()
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
 
-keystore=os.environ["keystore"]
-
-ctxt.load_directory(keystore)
-
+# retrieve principals' keyid value from local credential files
 alphaID=ABAC.ID("Alpha_ID.pem");
 alphaID.id_load_privkey_file("Alpha_private.pem");
@@ -37,4 +41,17 @@
 
 ##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# Is Joe getting a pay raise ?
 # role=[keyid:alpha].role:payRaise 
 # p=[keyid:Joe]
@@ -49,4 +66,5 @@
 
 ##########################################################################
+# Is Maryann getting a pay raise ?
 # role=[keyid:alpha].role:payRaise 
 # p=[keyid:Maryann]
@@ -58,18 +76,2 @@
     print "%s <- %s" % (c.head_string(), c.tail_string())
 
-
-##########################################################################
-# dump the loaded principals/policies
-#
-out = ctxt.context_principals()
-print "\n...final principal set..."
-for x in out[1]:
-    print "%s " % x.string()
-print "\n"
-out = ctxt.context_credentials()
-print "\n...final policy attribute set..."
-for c in out[1]:
-    print "%s <- %s" % (c.head_string(), c.tail_string())
-print "\n"
-
-
Index: examples/python_tests/payraise_rt1/run_test
===================================================================
--- examples/python_tests/payraise_rt1/run_test	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/payraise_rt1/run_test	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -1,7 +1,3 @@
 #!/bin/sh 
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
-
 
 echo '---setup principals'
Index: examples/python_tests/payraise_rt1/setup.py
===================================================================
--- examples/python_tests/payraise_rt1/setup.py	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/payraise_rt1/setup.py	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,6 @@
 
 """
-  to test with python
-
-
+See README for the semantics.  This creates principals
+used by the example.
 """
 import os
Index: examples/python_tests/runall
===================================================================
--- examples/python_tests/runall	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/runall	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -12,7 +12,4 @@
     exit 1
 fi
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 for i in `ls -1 `; do
Index: examples/python_tests/runcheck
===================================================================
--- examples/python_tests/runcheck	(revision 47d5cf98015ecd9eee00b2d9a4dd2f7e57f042ea)
+++ examples/python_tests/runcheck	(revision f824a9ec465246e1555b44ec89522ae2ad35c47e)
@@ -2,7 +2,4 @@
 
 rm -rf allout.tmp
-
-ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
-export ABAC_PROVER_PATH
 
 echo 'running libabac PYTHON testing...'
