code: func (cgs *credentialGraphSet) HeadCredential(pe *pathexp.PathExp, name string) (envelope.CredentialInf, error) {
  	var head envelope.CredentialInf
  	version := -1
  
  	gpe, err := pe.WithInstance("*")
  	if err != nil {
  		return nil, err
  	}
  
  	graphs, ok := cgs.graphs[gpe.String()]
  	if !ok {
  		return nil, nil
  	}
  
  	sort.Sort(graphSorter(graphs))
  	for _, graph := range graphs {
  		creds := graph.GetCredentials()
  		for _, cred := range creds {
  			if cred.PathExp().Equal(pe) && cred.Name() == name && cred.CredentialVersion() > version {
  				env := cred
  				head = env
  				version = cred.CredentialVersion()
  			}
  		}
  	}
  
  	return head, nil
  }
docs: // HeadCredential returns the most recent version of a Credential that shares
  // the provided PathExp and Name
  //
  // A Head Credential need not be in the Head of the CredentialGraph.