Function resolve_identity 

pub fn resolve_identity(
    inputs: &IdentityInputs<'_>,
) -> ValidationResult<ResolvedIdentity>

Resolve a ResolvedIdentity from defaults, an optional Repository/ ClusterRepository identity expression set, and explicit consumer overrides (ADR §4.2 / ADR-0004 §5).

Precedence per component: explicit override, then expression, then default. For hostname specifically, the default step itself has two tiers: with IdentityDefaults::cluster set, the default is <namespace>.<cluster> (M1, multi-cluster shared repositories); otherwise it’s the bare namespace (ADR §4.2). So the full hostname chain, highest precedence first, is: explicit override, hostnameExpr, <namespace>.<cluster> (cluster set), namespace. username is unaffected — cluster is not part of its default. Returns a ValidationError::IdentityExprCompile/IdentityExprEval/IdentityExprType if a supplied expression fails (so the webhook rejects it at admission rather than pinning garbage).

use kopiur_api::{IdentityInputs, resolve_identity, identity_string};

// Bare defaults: username <- object name, hostname <- namespace,
// sourcePath <- /pvc/<pvcName> (ADR §4.2).
let inputs = IdentityInputs {
    object_name: "postgres-data",
    namespace: "billing",
    overrides: None,
    defaults: None,
    labels: None,
    annotations: None,
    pvc_name: Some("postgres-data"),
    default_source_path: None,
    source_path_override: None,
};
let id = resolve_identity(&inputs).unwrap();
assert_eq!(id.username, "postgres-data");
assert_eq!(id.hostname, "billing");
assert_eq!(id.source_path.as_deref(), Some("/pvc/postgres-data"));
assert_eq!(identity_string(&id), "postgres-data@billing:/pvc/postgres-data");