Specivo 0.12.0 connects the tracker to where code lives. Repositories on GitHub, GitLab, Gitea and Forgejo now link their commits, branches and pull requests to issues, and outgoing webhooks tell other systems what changed. Single sign-on gains offboarding that actually cuts people off, plus SCIM provisioning. Wiki pages and issues render Mermaid diagrams, the timer finally has a UI, and the user guide is now available in Simplified Chinese.

Repository integrations

Each project can connect its own repositories under Settings → Repositories. Specivo gives every integration its own webhook URL and secret, so the old global push hooks are gone. The repository integrations guide walks through the setup for each forge.

  • Commits, branches and pull requests. A commit message, branch name or pull request that mentions ACME-12 links to that issue. The issue gets a note from the Git account, and the pull request and branch are added to its metadata.
  • Development panel. The issue page shows its linked commits, branches and pull requests with their live state. The same list is available from GET /api/v1/issues/{ref}/development/ and in the MCP specivo_show_issue output.
  • Copy branch name. A button on the issue page copies a ready-made branch name, such as feat/ACME-12-export-to-csv. Each project sets its own format, and pushing that branch links it back to the issue.
  • Commit commands. Fixes ACME-12 on the default branch moves the issue to its fixing status, and ACME-12 @1h30m logs time. Both act as the person whose verified email wrote the commit, with that person's permissions and workflow. An administrator matched this way gets only their project roles, never admin rights. Commands are off by default.
  • Merge automation. When a pull request that says Fixes ACME-12 is merged, the issue moves through the normal workflow. Only the merge itself counts: edits made to the pull request afterwards cannot close anything. This is also off by default, and it acts through a dedicated Automation role whose transitions you choose.
  • Pull requests from outsiders. On a public repository, anyone can open a pull request that names issues. A new option, on by default, ignores pull requests from forks and from people who are not collaborators.
  • Renamed keys. References to an old project key, or to an issue that moved to another project, still resolve.

Gitea and Forgejo can also send their own issue links to Specivo. The issue links guide shows the external tracker settings for both.

Outgoing webhooks

Outgoing webhooks now fire. Issue and wiki changes are written to an outbox in the same transaction as the change, then delivered with retries and backoff, so nothing is lost and nothing is sent for a change that rolled back. Each project has a Webhooks settings tab with a delivery log, payloads are signed with X-Specivo-Signature, and settled deliveries are pruned after 30 days. Private issues and private notes are sent only when an administrator turns that on for the webhook. The webhooks guide has the payloads and signature checks in Python and Node.js.

Single sign-on: offboarding and SCIM

Until now, a person disabled at the identity provider kept their Specivo session until it expired, and kept their API keys. This release closes that gap.

  • Session check at the identity provider. When a session renews, Specivo asks the identity provider whether the person may still sign in. Someone disabled, deleted or signed out there loses their Specivo session within minutes, with any OpenID Connect provider that issues refresh tokens and without back-channel logout. If the provider cannot be reached, a per-provider setting decides whether to allow or end the session.
  • Back-channel logout actions. Each provider chooses what a logout from the provider does: end that one session, end all of the person's sessions, or also switch off their API keys, including MCP keys. Accounts with a Specivo password and service accounts are never deprovisioned this way.
  • SCIM 2.0. An identity provider such as Microsoft Entra ID, Okta or authentik can now create, update and deactivate Specivo accounts and groups. Each provider gets its own SCIM token. Deactivating someone there ends their sessions and switches off their API keys at once. Existing accounts are linked only by verified email, and only when the provider is set to link existing accounts. The SCIM guide covers setup for each provider.

The offboarding section of the single sign-on guide has a runbook per identity provider.

Mermaid diagrams

A ```mermaid fenced block in a wiki page, issue description or comment now renders as a diagram: flowcharts, sequence diagrams, state machines, entity relationships, Gantt charts and the rest. Mermaid ships with Specivo, so it works on air-gapped installs, and it runs in strict mode, so a stored diagram cannot run script. The source stays in the text, so search, exports and MCP reads still see it. On a phone, wide diagrams scroll sideways.

AI agents learn about this when they connect: the MCP server's instructions and specivo_setup_guide now tell them to draw diagrams with Mermaid instead of ASCII art.

A timer you can use

The timer worked only through the REST API before. Now you can start it from the issue page, see it tick in the header, and stop it with an activity and a comment, or discard it. Starting a timer while another one runs asks first, and afterwards says what happened to the old one. Agents get the same through the new MCP tool specivo_timer. See time tracking.

MCP improvements

  • Issue parents. specivo_create_issue and specivo_update_issue take parent_ref, specivo_list_issues can filter by it, and specivo_show_issue lists the parent and children the reader can see.
  • Tags at creation. specivo_create_issue and specivo_create_wiki take tags, applied in the same transaction.
  • A complete setup guide. It now lists every tool, explains the tag workflow, and tells agents not to write tags or status into the text of a page.

Notification emails that thread

All mail about one issue now shares one subject, [ACME-12] Subject, and threading headers, so Gmail, Thunderbird and other clients group it into one conversation. The event moved into the first line of the body. Mail carries a proper plain-text part, and auto-reply suppression headers keep out-of-office replies away. The new optional setting SMTP_MESSAGE_ID_DOMAIN sets the domain of the message ids.

In Chinese

The user guide is available in Simplified Chinese, page for page, and the repository has a Chinese README. The interface translations for Chinese, Russian, French, Spanish and Thai were completed for the strings that had gaps. Docker Hub is unreachable in some networks, so every release is now also published to the GitHub Container Registry as ghcr.io/specivo/specivo, with the same tags and the same image digests. Set SPECIVO_IMAGE=ghcr.io/specivo/specivo in .env to pull from there.

Access fixes

  • Time on private issues. Time entries on issues the reader cannot see were listed and counted in totals, reports and billing. They are now hidden everywhere, and the person who logged the time still sees their own entries.
  • Notifications. Watchers and assignees who can no longer see an issue no longer get notifications or email about it.
  • Not-found answers. A hidden issue under an old reference now answers exactly like an unknown one.

Other fixes

  • The bundled nginx could fail to start because the API took its fixed address on the proxy network. Automatic addresses now come from a separate range, SPECIVO_PROXY_IP_RANGE.
  • Moving an issue that has children under a new parent is refused when its subtree would go past the depth limit.
  • The timer button in the header now tells screen readers the elapsed time.

What to do when upgrading

Back up your database first: this release runs database migrations 0044 to 0051.

  • Git push hooks. The global /hooks/github and /hooks/gitlab endpoints are gone. Connect each repository again under the project's Repositories tab, and include pull or merge request events.
  • Fixed nginx address. If you set SPECIVO_NGINX_IP to work around the nginx start-up problem, remove it, or move it outside the automatic range.
  • Timer API. POST /api/v1/timer/start/ now also returns replaced, describing a timer it stopped.

How to get it

Pull the Docker image with docker pull specivo/specivo:0.12.0, or docker pull ghcr.io/specivo/specivo:0.12.0 where Docker Hub is unreachable. For servers without internet access, the GitHub Release includes an offline bundle. The source is at github.com/specivo/specivo. For installation and upgrade steps, see the user guide.

GitHub, GitLab, Gitea, Forgejo, Microsoft Entra ID, Okta and authentik are trademarks of their respective owners. Specivo is not affiliated with or endorsed by them.