diff --git a/claude/CLAUDE.md b/claude/CLAUDE.md
index 37e0b399..eb87119f 100644
--- a/claude/CLAUDE.md
+++ b/claude/CLAUDE.md
@@ -126,3 +126,11 @@ Rules for consistent, clean git commit history across all projects.
 ### Pull requests
 
 - ALWAYS create PRs with `gh pr create --fill`. Use `--title` / `--body-file` ONLY when the user explicitly asks for a custom title or body.
+
+## Codex Sandbox Network Retries
+
+This section applies only to Codex and its command execution tools.
+
+When a command required for the user's authorized task fails because of sandbox or proxy network restrictions, rerun the same command with `sandbox_permissions: "require_escalated"` and a concise `justification`. Proceed directly through the tool's approval flow so existing `allow` rules can apply and any additional approval can be requested there.
+
+Command `allow` rules and proxy domain permissions are separate controls: an allowed command can still fail during ordinary sandbox execution. Perform the escalated retry before reporting the task as blocked. Keep the retry within the authorized task and preserve the configured network restrictions.
diff --git a/codex/rules/himkt.rules b/codex/rules/himkt.rules
index 45947b9c..e8ed305b 100644
--- a/codex/rules/himkt.rules
+++ b/codex/rules/himkt.rules
@@ -96,6 +96,20 @@ prefix_rule(
     not_match = ["git push", "git commit-tree abc123"],
 )
 
+prefix_rule(
+    pattern = ["git", "diff"],
+    decision = "allow",
+    match = ["git diff"],
+    not_match = ["git push"],
+)
+
+prefix_rule(
+    pattern = ["git", "log"],
+    decision = "allow",
+    match = [["git", "log", "--oneline"], "git log"],
+    not_match = ["git push", "git commit-tree abc123"],
+)
+
 prefix_rule(
     pattern = ["herdr", "pane", "read"],
     decision = "allow",
diff --git a/mise/config.toml b/mise/config.toml
index f0956a8a..eb91fc48 100644
--- a/mise/config.toml
+++ b/mise/config.toml
@@ -6,7 +6,7 @@ min_version = "2026.8.14"
 "~/.claude/skills" = { source = "../skills", mode = "symlink-each" }
 "~/.codex/AGENTS.md" = "../claude/CLAUDE.md"
 "~/.codex/hooks.json" = "../codex/hooks.json"
-"~/.codex/rules" = { source = "../codex/rules", mode = "symlink-each" }
+"~/.codex/rules" = { source = "../codex/rules", mode = "symlink" }
 "~/.config/ghostty" = "../ghostty"
 "~/.config/git" = "../git"
 "~/.config/herdr" = { source = "../herdr", mode = "symlink-each" }