CoStrict: An Apache-2.0 AI Coding Assistant Built Around a Strict-Mode Workflow

The Problem CoStrict Targets: Unreviewed AI Code in Regulated Repositories

Most AI coding tools optimise for the moment of generation. You type a comment, a function appears, you accept it. CoStrict is aimed at the opposite end of that trade-off. Its README describes it as a strict AI coder for enterprises and lists strict mode first among core capabilities: requirements analysis, architecture design, task planning and test generation before the code itself. That ordering is the product thesis. The assumption is that an organisation has code review, audit or compliance obligations that make an unreviewed diff expensive, and that slowing generation down is cheaper than cleaning up afterwards. The target user is not an individual developer prototyping on a weekend. It is a team that already has a review process and wants AI output to enter that process in a form reviewers can reason about. The README also lists private deployment with physical isolation and end-to-end encryption, which tells you the intended buyer has network restrictions that rule out hosted-only assistants. CoStrict is free and open source under Apache-2.0, so the licence cost is zero; the cost that remains is operational, and the documentation is explicit that private deployment is a supported path rather than an afterthought.

Strict Mode: A Pipeline, Not a Prompt

The README describes strict mode as standardising AI-generated code workflows for enterprise scenarios, with the four stages listed above. What the repository material does not provide is the internal implementation of those stages, so treat the following as the documented contract rather than a verified mechanism. The observable behaviour is that a request enters a requirements phase, then architecture design, then task planning, then test generation, and only after that does code get produced. The practical consequence is that the agent holds more state per request than a completion engine does. Test generation is part of the pipeline rather than a follow-up command, which means the output of a strict-mode run is a change set with tests attached. That is a meaningful difference from assistants where tests are something you ask for separately and may never ask for at all. The cost is latency and token consumption per task, and the README acknowledges context pressure elsewhere by offering a Lite Mode that reduces context usage and token consumption. The existence of Lite Mode next to strict mode is the clearest signal that the team knows the strict pipeline is heavy and expects users to switch between the two depending on the task.

Code Review Uses Repository Indexing and Multiple Models

The second capability in the README is code review: repository-wide RAG-based code analysis with multi-expert model verification. Two mechanisms are named here. The first is retrieval over an index of the repository, which means review is not limited to the diff in front of you; the assistant can pull in related files before commenting. The second is verification by more than one model, described as multi-expert. The README does not state how disagreements between models are resolved, how many models participate, or whether the verification models are configurable, so anyone evaluating review quality should treat that as an open question to check in the documentation rather than assume a specific arbitration scheme. What can be said is that running review through multiple models multiplies inference cost per review, and that cost lands on whoever pays for the API keys or hosts the models. The README lists built-in free models plus support for Anthropic, OpenAI, OpenAI-compatible APIs and local models, so the multi-model verification step can in principle be satisfied by local weights if the deployment requires it. For an organisation already running private inference, that combination is the reason to look at CoStrict at all.

Getting It Running: Extensions, CLI and the OpenSpec Command

Installation is documented across four surfaces. For VS Code there are two marketplace entries, zgsm-ai.zgsm for the latest release and zgsm-ai.zgsm-nightly for nightly builds, so the extension identifier you install depends on whether you want stability or the newest code. The JetBrains plugin lives in a separate repository, zgsm-sangfor/costrict-for-jetbrains, with downloads linked from costrict.ai/download, which means JetBrains users track a different release cadence from VS Code users. There is also a CLI tool with its own installation guide at docs.costrict.ai/cli/guide/installation, and a cloud option documented at docs.costrict.ai/cli/product-characteristics/cloud. Private deployment is documented separately at docs.costrict.ai/en/deployment/introduction; the README does not inline the deployment steps, so the network topology, database requirements and certificate handling all have to be read from that page. On the configuration side, the README names API and model customisation with support for Anthropic, OpenAI, OpenAI-compatible endpoints and local models. It also documents an OpenSpec integration for change proposals, invoked with the /openspec-init command, which points at the Fission-AI/OpenSpec project. If your team already has a proposal format, that integration is the piece to examine first, because it is the one place where CoStrict imposes an external convention.

Where CoStrict Is the Wrong Tool

The strict pipeline is a poor fit for small edits. If you want to rename a variable or add a null check, routing that through requirements analysis, architecture design, task planning and test generation is overhead you will not recover. The README's own Lite Mode exists for the cases where the full pipeline costs more than it returns, and reaching for strict mode by default is a misuse of the design. The second limitation is deployment. Private deployment with physical isolation is listed as a capability, but the README does not describe the operational surface: no sizing guidance, no statement of which services must be reachable, no upgrade procedure for the on-premise components. Organisations without the capacity to run and patch that stack should assume the hosted or extension-only path, and those organisations lose the isolation property that is the main reason to pick CoStrict over a hosted competitor. Third, the multi-model verification in code review has an unstated cost profile. The README does not say whether verification runs on every review or only on flagged changes, so the per-review inference bill is not something you can predict from the repository material alone. Finally, the release cadence visible in the repository is fast, with v3.0.19, v3.0.20 and v3.0.21 appearing between August and September 2026. Frequent releases are not a defect, but they do mean the extension you install today will prompt for updates often, and teams that pin versions need a policy for that.

How CoStrict Differs From Cline and Roo Code

The topics list on the repository includes cline, roocode, kilo-code and opencode, which places CoStrict in the same family of agentic coding extensions rather than in the autocomplete category. The difference in approach is where the process lives. Cline and Roo Code are agent loops driven by the model and the user's prompts; the workflow is whatever you and the model agree on in the conversation. CoStrict moves that workflow into the product as a named mode with fixed stages, and adds repository-wide retrieval plus multi-model verification on the review side. The trade is flexibility for repeatability. You give up the ability to improvise a different sequence of steps, and in exchange a strict-mode run produces artifacts in a predictable order that a reviewer or an auditor can follow. The OpenSpec integration reinforces the same choice: change proposals follow an external specification instead of a team-specific template. If your team's value comes from adapting the agent's behaviour per task, the fixed pipeline will feel like a cage. If your team's problem is that every developer's AI workflow is different and none of them are documented, the fixed pipeline is the point.

Maintenance, Licence and Upgrade Cost

CoStrict is Apache-2.0, which permits commercial use, modification and redistribution, and includes a patent grant. It does not impose copyleft obligations on your own code. That is the extent of what can be said here; if you are redistributing a modified build or embedding it in a product, read the licence text and get your own advice rather than relying on a summary. On maintenance, the repository shows an active release stream through September 2026 and a single default branch, main. The README documents two features that directly reduce operational burden: automatic cleanup of history to reduce disk usage, and import/export of history records for offline migration. The second one matters if you run private deployment and need to move a developer's session state between machines or between environments, since it means the history is portable rather than trapped in a local store. What the material does not provide is a compatibility statement between extension versions and the private deployment backend. With releases landing roughly monthly, the question to answer before rollout is whether a backend upgrade is required when the extension updates, and that answer is not in the README.

Editorial conclusion

Adopt CoStrict if you need an AI coding assistant that can run inside your own network and you are willing to pay for that with a heavier generation workflow. Skip it if you want a single-file autocomplete plugin with no review step, or if you cannot run the private deployment stack. Before committing, verify the private deployment documentation at docs.costrict.ai/en/deployment/introduction against your own network layout, and check the OpenSpec integration path if you rely on existing change-proposal conventions.

Official sources

1. License: Apache-2.0
2. Project website
3. README
4. Releases
5. zgsm-ai/costrict on GitHub