chore: add NOTICE carving brand fonts out of the MIT grant

LICENSE

@@ -2,6 +2,10 @@ MIT License
 
 Copyright (c) 2026 Base
 
+NOTE: Some files in this repository are excluded from this license. See NOTICE
+for the exceptions, which include the Base Sans brand typefaces under
+public/fonts/, and for third-party attribution.
+
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights

NOTICE

@@ -0,0 +1,73 @@
+NOTICE
+======
+
+This project is released under the MIT License (see LICENSE), with the
+exceptions listed below. Where this file and LICENSE disagree, this file
+governs for the files it names.
+
+
+Base Sans and Base Sans Mono (brand typefaces) — NOT MIT licensed
+-----------------------------------------------------------------
+
+    public/fonts/BaseSans/*
+    public/fonts/BaseSansMono/*
+
+These typefaces are Base's proprietary brand assets. Copyright (c) Base. All
+rights reserved.
+
+They are included in this repository solely so that this application renders
+with correct branding. They are NOT covered by the MIT license in LICENSE, and
+no license to them is granted by it. You may not copy, redistribute, embed,
+modify, sublicense, or otherwise use these font files outside of this project.
+
+If you fork this repository or reuse its code, remove these files and
+substitute your own typeface. Note that they are loaded via next/font/local in
+app/layout.tsx, so deleting the files alone will fail the build — remove the
+corresponding localFont() declarations too. The CSS font stack in
+app/globals.css already lists system fallbacks, so the app renders without them.
+
+
+Doto
+----
+
+    public/fonts/Doto/*
+
+Licensed under the SIL Open Font License, Version 1.1.
+See https://openfontlicense.org
+
+
+Bundled third-party code
+------------------------
+
+    vendor/aa/index.js
+
+A prebuilt bundle that inlines portions of the following MIT-licensed projects.
+Their copyright notices and permission notices apply to the corresponding
+portions of that file, and are retained here to satisfy the MIT attribution
+requirement:
+
+  viem      — Copyright (c) 2023-present weth, LLC — https://github.com/wevm/viem
+  ox        — Copyright (c) 2024-present weth, LLC — https://github.com/wevm/ox
+  abitype   — Copyright (c) 2022-present weth, LLC — https://github.com/wevm/abitype
+  @noble/hashes, @noble/curves
+            — Copyright (c) 2022 Paul Miller — https://github.com/paulmillr
+
+Each is distributed under the MIT License:
+
+    Permission is hereby granted, free of charge, to any person obtaining a
+    copy of this software and associated documentation files (the "Software"),
+    to deal in the Software without restriction, including without limitation
+    the rights to use, copy, modify, merge, publish, distribute, sublicense,
+    and/or sell copies of the Software, and to permit persons to whom the
+    Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+    DEALINGS IN THE SOFTWARE.

README.md

@@ -116,3 +116,10 @@ guard on `surfaceEnabled(...)`. `deploy.config.test.mjs` covers the matrix logic
 Deployed on Vercel (external target). Push to the default branch to ship; pull
 requests get preview deployments. The internal target is built and deployed
 separately by the `protocols/ui` (cb/ui) shell repo.
+
+## License
+
+MIT — see [LICENSE](LICENSE), with the exceptions in [NOTICE](NOTICE). The Base
+Sans brand typefaces under `public/fonts/` are **not** MIT licensed and may not
+be reused outside this project; `NOTICE` also carries third-party attribution
+for the bundled code in `vendor/aa/`.