Attribution and grouping gaps: subagent spend, project rollups, harness split, session token column

[willwashburn]

Problem

Several related gaps in how spend gets attributed and grouped make it hard to answer "who/what actually spent this" at the project or harness level:

1. Subagent spend doesn't roll up to the parent project. 100 subagent sessions were left as unattributed orphans in the 2026-07-30 fleet forensics. As a direct result, the chief project was undercounted at 290M tokens when the real total (including its subagents) was 462M — a 37% miss on one project alone.
2. No --group-by project option on summary/hotspots/findings, so this kind of rollup has to be done by hand every time instead of queried directly.
3. No harness split in --bucket time series. Cost/token time buckets don't separate Claude vs. Codex vs. OpenCode, so a spend spike can't be attributed to a harness without re-deriving it from raw session data.
4. sessions list has no token column. The session listing surfaces things like duration and turn count but omits total tokens, forcing a join against another verb just to see relative token weight across sessions.

Evidence

2026-07-30 fleet spend forensics (two independent pipelines, results agreeing within 1.4%): 100 orphaned subagent sessions; chief project 290M (undercounted) vs. 462M (actual, subagents included).

Related

#435 (closed) already pairs Task subagents to a parent via toolUseResult.agentId at the reader level — this issue is about that pairing actually reaching project-level rollups and the CLI grouping surface, since the orphans are still showing up downstream of that fix.

Fix

• Ensure subagent sessions inherit/roll up to the parent project's totals wherever project-level aggregation happens.
• Add --group-by project to summary/hotspots/findings.
• Add harness dimension to --bucket time-series output.
• Add a token(s) column to sessions list.

[willwashburn]

Fresh resident reproduction after burn ingest on 2026-07-30: the 24h summary reports 71 subagents, 67 orphaned; --group-by-tag agentId, harness, and persona each collapse 3,476 turns into a blank value; sessions list still exposes turns/cost/models but not tokens or harness. Answering the fleet report required enumerating 24 project paths and issuing one Burn summary per project, plus one session summary per short Codex session. The native hourly bucket is useful, but cannot attribute a spike by harness/project. No duplicate issue filed; this confirms #506 with the fresh resident ledger.