diff --git a/AGENTS.md b/AGENTS.md
index 1bde90e..6a5f08a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -85,7 +85,7 @@ Today no module imports another at all; the layers say what is *allowed* if one
 Concrete rules that follow from this:
 
 - **OpenTelemetry API vs SDK.** `logger/*`, `grpcx`, and `dbx` may import `go.opentelemetry.io/otel` (the API), `otel/trace`, `otel/metric`, and contrib instrumentation (`otelgrpc`, `otelpgx`). They must **never** import `go.opentelemetry.io/otel/sdk` or `duynhlab/pkg/obsx`. The SDK lives in `obsx` and nowhere else. This is what lets a service use `grpcx` without being forced to link the OpenTelemetry SDK. (Tests are exempt: in-memory exporters need the SDK.)
-- **`obsx`, `temporalx`, and `migratex` are wired in `main()` only.** Service business packages must not import them. `dbx` is exempt from this rule — repository/store code may use it — but no module *in this repo* may.
+- **`obsx`, `temporalx`, and `migratex` are wired in `main()` only.** Service business packages must not import them, with one narrow exception: temporalx's workflow-side helpers — `Tracer` for replay-safe spans, `WorkflowEvent`, and `WorkflowFailed` — are for workflow, activity and dispatcher code, because the event catalog assigns those events to temporalx and only it may write from workflow code. Construction (`Dial`, `NewWorker`, `WithLogger`) stays in `main()`. `dbx` is exempt from this rule — repository/store code may use it — but no module *in this repo* may.
 - **`migratex` does not import `dbx`.** It accepts a DSN string. Keeping them independent means a migration job binary does not link the pool implementation and vice versa.
 - **`grpcx` does not import `proto`.** Interceptors are generic. Anything that needs a concrete message type belongs in the service.
 - **`httpx` and `authmw` do not import each other.** Both produce gin middleware/helpers. Composition happens in the service.