Four Subcommands and One Required Check: Maintaining an AI code review Workflow After You Install It
Installing OrcaCode Review takes one command. Running it for a year takes four subcommands and one setting in GitHub that the tool cannot change for you. The surface is described on OrcaRouter under AI code review: agent mode via `npx @orcarouter/code-review`, manual mode via a workflow file you commit yourself, and a lifecycle of `init`, `reconfigure`, `doctor` and `uninstall`. This article is about the part that comes after the first pull request — the maintenance, which is where a review bot either becomes load-bearing or becomes noise.
One caveat on the page itself: the URL renders through the front end, so the table of contents and lifecycle notes are visible in a browser but not in the raw response. Everything below is quoted from the page as rendered.
The four subcommands, and what each one is really for
`init` writes the workflow file into the repository. In agent mode the installer detects the coding agent already present — Claude Code, Cursor, Codex and the rest — and installs the corresponding skill; in manual mode you copy a `.yml` and commit it yourself. Both end at the same artefact: a workflow in your own CI, not a hosted service.
`reconfigure` changes the blocking rules, the diff cap and the configuration location. This is the subcommand a team uses most after the first month, because the defaults are a starting point rather than a policy. Whether a P1 finding should block a merge is an organisational decision, and it is the one knob that most changes whether developers experience the bot as a gate or as a comment.
`doctor` diagnoses a review that did not run. This is the subcommand that exists because the failure mode of an in-CI review is silence: a workflow that errors on a permissions problem produces no comment, and no comment looks exactly like a clean review.
`uninstall` removes it, and the tool explicitly reminds you to take down the required check first. That reminder is the most important line in the lifecycle documentation, because a required status check that never reports will block every merge in the repository — including the merge that would remove it.
The setting GitHub owns
An in-CI review integrates at one point: the workflow reports a status check, and branch protection can require that check. Once required, a P0 or P1 finding fails the check and blocks the merge until the finding is fixed or explicitly waived.
That is the gate, and it is enforced by GitHub rather than by the bot. Which means the two failure modes are not symmetric.
A false positive blocks a merge. The fix is a waiver or a rule change, and the cost is a developer’s afternoon. The alternative — not requiring the check — makes the review advisory, which is the state most code-review bots end up in.
The tool’s own documentation is honest about that trade. The severity rules and the merge gate are MIT-licensed and public, so the thing that decides what blocks your merge is readable before you install it. That is unusual among review products and it is the reason the licensing statement is on the product page rather than buried.
What a review costs, in the recipe’s own numbers
The pricing story here is not a seat. It is tokens, and the page publishes the recipe that produces the number.
About 250 model calls per review, about 35,000 tokens each, 96 percent of it served from cache and billed at 10 percent of the input rate. Measured on real runs at a $0.147 input / $0.295 output rate card, that comes to $45.19 a month on the page’s stated volume, or about $0.28 a review.
Two things about that arithmetic matter more than the total.
The recipe is the price. 250 calls and 35,000 tokens each is a default, not a limit. A six-lens review with a cheap screening pass and a strong final pass costs differently from a single strong pass, and the page says the formula is open source and the figure moves with the model you name. So the $0.28 is a statement about a specific default configuration, and any team’s real number is a function of its own recipe.
The cache share is doing most of the work. At 96 percent cache hits and 10 percent of input rate, the effective input cost is roughly a seventh of the nominal rate. A team whose diffs and repository context do not repeat will not see that ratio, and the same recipe will cost materially more. The $0.28 is a cached workload’s price.
The configuration that decides whether it is a gate or a comment
Four settings do more work than the rest.
Which severities block. The default gates P0 and P1. Widening it to P2 turns the bot into a merge blocker for stylistic findings and is the fastest way to get it removed. Narrowing it to P0 only makes it a crash detector.
The diff cap. Large pull requests generate large reviews, and a review of a refactor that touches a hundred files will be long, expensive and mostly ignored. The cap is a cost control as much as a quality control.
The model in the recipe. The default is a cheap one; the page’s own arithmetic uses a $0.147/$0.295 card. Naming a frontier model multiplies the per-review cost without necessarily improving the findings that block merges.
The waiver path. A gate without a documented way to say “we know, ship it” is a gate that gets disabled. The waiver should exist before the first false positive, not after.
What the guardrails change about a review’s scope
The page lists four guardrail categories active by default: leaked secrets flagged in every diff, personal data detected before it reaches any model, prompt injection in diffs or comments caught and flagged, and insecure patterns reported with severity labels.
The first two are about what leaves your repository. An in-CI review reads a diff and the surrounding code; if that text goes to a model without a filter, every credential accidentally committed becomes a third party’s data. The third matters because a diff is attacker-controlled input — anyone can open a pull request, and instructions hidden in a comment are a real vector against any agent that reads one.
Those three are the reason an in-CI review is different from a code assistant in an editor. The editor sees code you wrote; the review sees code anyone wrote, including the person testing whether your agent follows instructions embedded in a string.
How to run a review bot without regretting it
Four practices, drawn from the lifecycle above.
Keep the template in your repository. A workflow you committed is a workflow you can diff, review and revert. One generated by a wizard is one you discover during an incident.
Run `doctor` before assuming a clean review. Silence is the default failure state of an in-CI review, and no comment does not mean no findings.
Untick the required check before uninstalling. A required check with no reporter blocks everything. The tool tells you this; believe it.
Re-cost the recipe quarterly. The $0.28 figure is a cached workload’s price at a specific default. Diffs change, models change, rates change, and the number that was right in October will be wrong by spring.
The install is one command and the operation is four subcommands plus a checkbox in GitHub. That asymmetry is normal for developer tooling, and it is where the value either compounds or evaporates.
Also read: All Cursive Letters Uppercase and Lowercase Guide
Sourcing note: the subcommands, the install modes, the 250-call and 35,000-token recipe, the 96 percent cache share, the $45.19 monthly figure, the $0.28 per review, the P0/P1 gate behaviour, the MIT licensing of the rules and gate, and the four guardrail categories are all read from the OrcaRouter code review page as rendered on 2026-10-21 [OURS, with the $0.147/$0.295 rate card being the provider’s published rate passed through with $0 markup]. The maintenance practices are our own recommendations and not vendor guidance. No third-party review products are named or compared. All values checked 2026-10-21.
