feat(dao): proposal_cosign builder + dao_proposal_cosign_unsigned tool

Phase 4b. Cosign extends a Draft proposal's cosigners list — the
multi-stake bridge for clearing to_voting threshold when a single
stake doesn't have enough TRP. Validator (PCosign branch in
Proposal/Scripts.hs:433) requires:

- Status == Draft
- Exactly one stake input (ptryFromSingleton)
- New cosigner = stake.owner (delegatees rejected)
- Cosigner inserted into list via pinsertUniqueBy (sorted, no dupes)
- len(cosigners) ≤ max_cosigners (DaoConfig.max_cosigners)
- stake.staked_amount ≥ thresholds.cosign

Stake-side (ppermitVote PCosign branch): owner signs (not delegatee),
single stake input, new lock = ProposalLock { proposal_id, Cosigned }
prepended via paddNewLock = pcons.

Insertion order mirrors Plutarch's pfromOrdBy-derived Credential Ord:
variant index first (PubKey=0 < Script=1), then 28-byte hash lex.
`insert_unique_sorted` test-covered for low/mid/high positions + the
PubKey-before-Script invariant.

Also extract pull_wallet_utxos free function in tools.rs — shared
between the (future) refactor of create/vote and immediately by
cosign. Inline duplication in create/vote left as a future cleanup.

11 unit tests on the builder. Tool args: dao? + proposal_id +
fee_lovelace.

crates/aldabra-mcp/src/tools.rs

@@ -37,6 +37,9 @@ use aldabra_dao::builder::proposal_create::{
 use aldabra_dao::builder::proposal_vote::{
     build_unsigned_proposal_vote, ProposalUtxoIn, ProposalVoteArgs,
 };
+use aldabra_dao::builder::proposal_cosign::{
+    build_unsigned_proposal_cosign, ProposalCosignArgs,
+};
 use aldabra_dao::config::{DaoConfig, DaoNetwork, DaoStore, ScriptRefs};
 use aldabra_dao::discovery::{
     apply_discovery, discover_scripts, KoiosDiscoveryClient, MAINNET_AGORA_SHARED_DEPLOYER,
@@ -1799,6 +1802,173 @@ impl WalletService {
         .to_string())
     }
 
+    #[tool(
+        name = "dao_proposal_cosign_unsigned",
+        description = "Build (but DO NOT submit) an unsigned cosign tx that adds the wallet's stake as a cosigner of a Draft proposal. Used to bridge a single stake's amount being below the to_voting threshold — multiple cosigners' stakes sum when the proposal advances. Only the stake owner can cosign (delegatees rejected per validator). Args: dao (optional — defaults to active), proposal_id (i64; must be in Draft), fee_lovelace (~2_500_000)."
+    )]
+    async fn dao_proposal_cosign_unsigned(
+        &self,
+        #[tool(aggr)] DaoProposalCosignArgs {
+            dao,
+            proposal_id,
+            fee_lovelace,
+        }: DaoProposalCosignArgs,
+    ) -> Result<String, String> {
+        let cfg = self
+            .inner
+            .dao_store
+            .resolve(dao.as_deref())
+            .map_err(|e| e.to_string())?;
+
+        // Find the proposal.
+        let proposals = self
+            .inner
+            .dao_reader
+            .list_proposals(&cfg)
+            .await
+            .map_err(|e| e.to_string())?;
+        let target = proposals
+            .into_iter()
+            .find(|p| p.datum.proposal_id == proposal_id)
+            .ok_or_else(|| {
+                format!(
+                    "no proposal with proposal_id={} found at {}",
+                    proposal_id,
+                    cfg.proposal_addr.as_deref().unwrap_or("<unset>"),
+                )
+            })?;
+        let (prop_tx, prop_idx) = parse_utxo_ref(&target.utxo_ref)?;
+
+        // Find the wallet's stake.
+        let cosigner_pkh = self.wallet_pkh()?;
+        let stakes = self
+            .inner
+            .dao_reader
+            .list_stakes(&cfg)
+            .await
+            .map_err(|e| e.to_string())?;
+        let my_stake = stakes
+            .into_iter()
+            .find(|s| match &s.datum.owner {
+                aldabra_dao::agora::stake::Credential::PubKey(h) => h == &cosigner_pkh,
+                _ => false,
+            })
+            .ok_or_else(|| {
+                format!(
+                    "no stake at stakes_addr owned by this wallet's pkh {} — \
+                     wallet must hold a registered stake to cosign",
+                    hex::encode(&cosigner_pkh)
+                )
+            })?;
+        let (stake_tx, stake_idx) = parse_utxo_ref(&my_stake.utxo_ref)?;
+
+        // StakeST asset name from chain.
+        let stake_utxos_raw = self
+            .inner
+            .chain
+            .get_utxos(&cfg.stakes_addr)
+            .await
+            .map_err(|e| format!("koios get stake utxos: {e}"))?;
+        let stake_utxo_raw = stake_utxos_raw
+            .into_iter()
+            .find(|u| u.tx_hash == stake_tx && u.output_index == stake_idx)
+            .ok_or_else(|| format!("stake utxo {} no longer on chain", my_stake.utxo_ref))?;
+        let stake_st_asset_name_hex = stake_utxo_raw
+            .assets
+            .iter()
+            .find_map(|(k, _)| {
+                if k.len() < 56 {
+                    return None;
+                }
+                let (p, n) = k.split_at(56);
+                if p == cfg.stake_st_policy.as_deref().unwrap_or("") {
+                    Some(n.to_string())
+                } else {
+                    None
+                }
+            })
+            .ok_or_else(|| "stake UTxO is missing StakeST token".to_string())?;
+
+        // Tip slot for validity range.
+        let tip_resp = self
+            .inner
+            .chain
+            .get_raw_json("tip", &[])
+            .await
+            .map_err(|e| format!("koios tip: {e}"))?;
+        let tip: serde_json::Value =
+            serde_json::from_str(&tip_resp).map_err(|e| format!("tip parse: {e}"))?;
+        let tip_slot = tip
+            .as_array()
+            .and_then(|a| a.first())
+            .and_then(|t| t.get("abs_slot"))
+            .and_then(|s| s.as_u64())
+            .ok_or_else(|| format!("tip response missing abs_slot: {tip_resp}"))?;
+
+        // Wallet utxos.
+        let wallet_utxos = pull_wallet_utxos(&self.inner.chain, &self.inner.address).await?;
+
+        // ScriptRefs.
+        let stake_validator_ref = ReferenceUtxo::from_str(
+            cfg.script_refs
+                .stake_validator
+                .as_deref()
+                .ok_or_else(|| {
+                    "DaoConfig.script_refs.stake_validator missing — \
+                     run dao_discover_scripts first".to_string()
+                })?,
+        )
+        .map_err(|e| e.to_string())?;
+        let proposal_validator_ref = ReferenceUtxo::from_str(
+            cfg.script_refs
+                .proposal_validator
+                .as_deref()
+                .ok_or_else(|| {
+                    "DaoConfig.script_refs.proposal_validator missing — \
+                     run dao_discover_scripts first".to_string()
+                })?,
+        )
+        .map_err(|e| e.to_string())?;
+
+        let unsigned = build_unsigned_proposal_cosign(ProposalCosignArgs {
+            cfg: cfg.clone(),
+            stake_in: StakeUtxoIn {
+                tx_hash_hex: stake_tx,
+                output_index: stake_idx,
+                lovelace: my_stake.lovelace,
+                gov_token_qty: my_stake.gov_token_quantity,
+                stake_st_asset_name_hex,
+                datum: my_stake.datum,
+            },
+            proposal: ProposalUtxoIn {
+                tx_hash_hex: prop_tx,
+                output_index: prop_idx,
+                lovelace: target.lovelace,
+                proposal_st_asset_name_hex: target.proposal_st_asset_name_hex,
+                datum: target.datum,
+            },
+            cosigner_pkh,
+            change_address: self.inner.address.clone(),
+            wallet_utxos,
+            tip_slot,
+            stake_validator_ref,
+            proposal_validator_ref,
+            fee_lovelace,
+        })
+        .map_err(|e| e.to_string())?;
+
+        Ok(serde_json::json!({
+            "dao": cfg.name,
+            "tx_cbor_hex": unsigned.tx_cbor_hex,
+            "tx_hash_hex": unsigned.tx_hash_hex,
+            "proposal_id": unsigned.proposal_id,
+            "cosigners_count": unsigned.cosigners_count,
+            "summary": unsigned.summary,
+            "next_step": "review tx_cbor_hex (decode + audit), then sign via wallet_sign_partial + submit via wallet_submit_signed_tx",
+        })
+        .to_string())
+    }
+
     #[tool(
         name = "dao_proposal_vote_unsigned",
         description = "Build (but DO NOT submit) an unsigned vote tx for the given DAO proposal. Spends voter's stake (PermitVote redeemer) + the proposal UTxO (Vote(result_tag) redeemer) and outputs the same two with locks/votes mutated. Returns CBOR-hex of the unsigned tx body. Caller signs via wallet_sign_partial then submits via wallet_submit_signed_tx. Args: dao (optional — defaults to active), proposal_id (i64; matches ProposalDatum.proposal_id on chain), result_tag (i64; 0 or 1 for InfoOnly proposals), fee_lovelace (~2_500_000 reasonable for v1). Pre-flights every validator check: voter is owner-or-delegatee, status=VotingReady, no double-vote, stake clears threshold, result_tag valid, validity-upper inside voting window."
@@ -2153,6 +2323,17 @@ pub struct DaoProposalCreateArgs {
     pub starting_time_ms: i64,
 }
 
+#[derive(Debug, Deserialize, schemars::JsonSchema)]
+pub struct DaoProposalCosignArgs {
+    /// Named DAO. Falls through to active if omitted.
+    #[serde(default)]
+    pub dao: Option<String>,
+    /// Proposal id to cosign (must be in Draft status).
+    pub proposal_id: i64,
+    /// Estimated total fee in lovelace. ~2.5 ADA reasonable.
+    pub fee_lovelace: u64,
+}
+
 #[derive(Debug, Deserialize, schemars::JsonSchema)]
 pub struct DaoProposalVoteArgs {
     /// Named DAO. Falls through to active if omitted.
@@ -2197,6 +2378,47 @@ fn mainnet_slot_to_posix_ms(slot: u64) -> Result<i64, String> {
         .ok_or_else(|| "posix_ms add overflow".into())
 }
 
+/// Pull wallet UTxOs with H-5 strict asset-key parsing.
+///
+/// Shared by every DAO write-path tool that needs to fund + collateralize
+/// from the wallet. Surfaces malformed asset keys (< 56 chars) as errors
+/// instead of silently dropping them — a corrupt Koios response would
+/// otherwise let our builder construct a tx that loses native assets on
+/// submit. AUDIT-H5 fix from 2026-05-05.
+async fn pull_wallet_utxos(
+    chain: &KoiosClient,
+    address: &str,
+) -> Result<Vec<DaoWalletUtxo>, String> {
+    let raw = chain
+        .get_utxos(address)
+        .await
+        .map_err(|e| format!("koios get wallet utxos: {e}"))?;
+    let mut out = Vec::with_capacity(raw.len());
+    for u in raw {
+        let mut assets = Vec::with_capacity(u.assets.len());
+        for (k, q) in u.assets {
+            if k.len() < 56 {
+                return Err(format!(
+                    "malformed asset key in wallet utxo {tx_hash}#{idx}: \
+                     {k:?} is {len} chars, need ≥ 56 (policy_id_hex || asset_name_hex)",
+                    tx_hash = u.tx_hash,
+                    idx = u.output_index,
+                    len = k.len(),
+                ));
+            }
+            let (p, n) = k.split_at(56);
+            assets.push((p.to_string(), n.to_string(), q));
+        }
+        out.push(DaoWalletUtxo {
+            tx_hash_hex: u.tx_hash,
+            output_index: u.output_index,
+            lovelace: u.lovelace,
+            assets,
+        });
+    }
+    Ok(out)
+}
+
 /// Parse a `txhash#index` UTxO ref into its components.
 fn parse_utxo_ref(s: &str) -> Result<(String, u32), String> {
     let (h, i) = s
@@ -2263,7 +2485,7 @@ impl ServerHandler for WalletService {
         ServerInfo {
             capabilities: ServerCapabilities::builder().enable_tools().build(),
             instructions: Some(
-                "aldabra — Cardano lite wallet + DAO client over MCP. wallet_*: read (address/balance/utxos/network/stake_address), send (wallet_send with optional inline datum for script locks, wallet_send_unsigned + wallet_sign_partial + wallet_submit_signed_tx for cold/multi-sig, wallet_tx_status), mint (wallet_policy_create, wallet_mint with CIP-25 metadata, wallet_mint_cip68_nft for ref+user NFT pairs, wallet_mint_unsigned), Plutus (wallet_script_spend), stake (wallet_stake_delegate). chain_*: read-only Koios passthroughs (chain_tx_info, chain_address_info, chain_pool_list, chain_pool_info, chain_epoch_params, chain_asset_info, chain_account_info, chain_tip). dao_*: native Agora-on-Cardano DAO client. Multi-DAO via $ALDABRA_DATA/daos/<name>.json — register multiple DAOs (Sulkta, Bob's, Alice's), switch active with dao_use. Management: dao_register, dao_list, dao_use, dao_remove, dao_show. Live reads: dao_governor_state (thresholds + timing + nextProposalId), dao_stake_list (all stakes, filtered to the DAO's gov token), dao_my_stake (just this wallet's stake by pkh match). Write paths (unsigned-first; caller signs+submits): dao_proposal_create_unsigned (mint a new proposal), dao_proposal_vote_unsigned (vote on a VotingReady proposal). Each write tool pre-flights every Plutarch validator check client-side so failed txs don't burn fees.".into(),
+                "aldabra — Cardano lite wallet + DAO client over MCP. wallet_*: read (address/balance/utxos/network/stake_address), send (wallet_send with optional inline datum for script locks, wallet_send_unsigned + wallet_sign_partial + wallet_submit_signed_tx for cold/multi-sig, wallet_tx_status), mint (wallet_policy_create, wallet_mint with CIP-25 metadata, wallet_mint_cip68_nft for ref+user NFT pairs, wallet_mint_unsigned), Plutus (wallet_script_spend), stake (wallet_stake_delegate). chain_*: read-only Koios passthroughs (chain_tx_info, chain_address_info, chain_pool_list, chain_pool_info, chain_epoch_params, chain_asset_info, chain_account_info, chain_tip). dao_*: native Agora-on-Cardano DAO client. Multi-DAO via $ALDABRA_DATA/daos/<name>.json — register multiple DAOs (Sulkta, Bob's, Alice's), switch active with dao_use. Management: dao_register, dao_list, dao_use, dao_remove, dao_show. Live reads: dao_governor_state (thresholds + timing + nextProposalId), dao_stake_list (all stakes, filtered to the DAO's gov token), dao_my_stake (just this wallet's stake by pkh match). Write paths (unsigned-first; caller signs+submits): dao_proposal_create_unsigned (mint a new proposal), dao_proposal_cosign_unsigned (add wallet's stake as a Draft cosigner — multi-stake bridge), dao_proposal_vote_unsigned (vote on a VotingReady proposal). Each write tool pre-flights every Plutarch validator check client-side so failed txs don't burn fees.".into(),
             ),
             ..Default::default()
         }