test(fleet): exercise active consumer filtering

Author: hyperpolymath

scripts/propagate-sha-bump.sh

@@ -253,8 +253,9 @@ filter_forks() {
     mv "$out" "$tsv"
 }
 
-# Skip fork-filter if the operator supplied an override TSV — they've already vetted it.
-if [[ -s "$CONSUMERS_TSV" && -z "${CONSUMERS_TSV_OVERRIDE:-}" ]]; then
+# Apply the same active-root eligibility check to searched and overridden
+# consumers so the test seam cannot bypass the production safety boundary.
+if [[ -s "$CONSUMERS_TSV" ]]; then
     filter_forks "$CONSUMERS_TSV"
 fi
 

tests/propagate-sha-bump-smoke.sh

@@ -25,6 +25,7 @@ case "$*" in
   *'/compare/'*) printf '%s\n' "${MOCK_COMPARE_STATUS:-ahead}" ;;
   *'/contents/'*) printf '%s\n' file ;;
   *'repos/hyperpolymath/standards --jq .default_branch'*) printf '%s\n' main ;;
+  *'--jq [.fork, .archived] | @tsv'*) printf 'false\tfalse\n' ;;
   *) printf '%s\n' '{}' ;;
 esac
 EOF
@@ -163,6 +164,14 @@ rc=$?
 set -e
 assert_exit "DRY_RUN with valid finding → exit 0" 0 "$rc"
 
+if printf '%s' "$out" | grep -q 'hyperpolymath/repo-a'; then
+    echo "ok    active override consumer remains eligible"
+    ((pass++))
+else
+    echo "FAIL  active override consumers were filtered out"
+    ((fail++))
+fi
+
 if printf '%s' "$out" | grep -q '"event_type": "propagate-sha-bump"'; then
     echo "ok    payload contains event_type"
     ((pass++))