Mustafa Sezer Başar

The rule engine of a field audit system built for an audit firm: an end-to-end working component that reads legislation with RAG and turns it into audit rules. The corpus is self-sourced: a collector he built pulls statutes and high-court rulings into a database, and the RAG layer works on top of it. Rules are held as JSON with their statute reference and validity period, pass a human review gate, and are then applied deterministically by a Go service. The LLM is not in the hot path — it runs offline — so every audit run stays reproducible and auditable. Taxpayer data never leaves the system: the external language model only ever sees public legislation.

• Python (LLM)
• Go
• Next.js
• MySQL

Target data architecture and staged migration path for a multi-country retail group: six documents, five decision records. The diagnosis is that volume is not the problem — ~150 million rows a year is a size one partitioned relational database carries comfortably. The problems are definition (one word, different numbers), authority (no single publisher) and latency (inconsistency is noticed only once it is large). So most of the architecture is a list of things deliberately not built: distributed processing, a data lake and streaming infrastructure are all out of scope with reasons. Power BI, Excel and language-model access all bind to the same semantic layer — a definition that does not live in one place lives in three and produces three different numbers. The model gets no free SQL; it gets metric-shaped tools and runs under the identity of whoever asked. The binding constraint on the migration order is adoption: no old path is closed before the new one is seen working. Design stage — no migration phase is complete, and the volume figures are derived from the shape of the business, not measured.

• Mimari tasarım
• katmanlı ilişkisel veri ambarı
• semantik katman
• ADR

Commercially built product that lets a guest check in without going to the front desk. It reached production readiness but was never deployed: the hotel management system used in the region was closed to outside integration. Three steps: the guest uploads an ID or passport and its text is read with Tesseract, takes a photo of themselves, and the two faces are matched with face_recognition — then location is verified, because a face match proves who someone is, not that they are at the hotel. Face data is a special category under Turkish data protection law, so the flow opens with an explicit consent gate and a guest who declines checks in face to face instead: consent without an alternative is not consent. No photograph is kept: once the comparison is done, only the numeric representation of the face remains, and the hotel sets how long it is held — under the Turkish data protection act the hotel is the data controller, so that decision belongs there. There is no liveness check; the system can be fooled by a photograph held up to the camera, and the location check does not close that gap.

• Python
• Tesseract OCR
• face_recognition

Full-stack system encrypting employee PII field by field with AES-256-GCM: a key per subject makes erasure the destruction of that key (crypto-shredding); plus role-aware masking, a hash-chained audit log and 64 adversarial tests generated from the policy table. Compliance claims come from an evidence report that fails the build when dirty.

• TypeScript
• Express
• node:sqlite
• Node crypto (AES)

End-to-end system written to collect rates daily from several booking channels (Booking, Hotels and others), keep them as a time series, and turn them into a price recommendation: collection runs through a Chrome extension in a real browser session after the headless approach was stopped by bot protection, with history in PostgreSQL behind an Express API and a React + Recharts interface. The recommendation's distinguishing input is competitor occupancy — rates are public, occupancy is not. It binary-searches the channel's availability query by raising the room count, which reveals the remaining inventory the competitor is willing to show, then divides by their published room count. No reservation is ever created; it only reads the availability response any customer can see. To find out how accurate the method actually is, wrote an open-source study: in a simulated market where true occupancy is known, the naive reading is 35 points out and a censored-regression estimator 12 — but when the revenue effect was measured, the gain did not beat a one-line control needing no collector at all, and it was reported that way.

• TypeScript
• Express
• node:sqlite
• Chrome Extension

A simulation study measuring how likely a project schedule is to meet its committed date. On a twenty-activity ERP migration schedule the deterministic critical path gives 105.2 days; simulated 40,000 times from the same estimates, that date is met in only 34% of runs. The gap comes from the shape of the network rather than the estimates: every merge point waits for the slowest of several parallel paths. Label-free control networks show the project finishing 12.6 days later purely from adding parallel paths, with no task lengthened. The criticality index was also measured to tie six activities at 1.0 while their influence on the finish differed 4.6-fold. Interventions were compared with common random numbers; the mechanism in the pre-registered hypothesis was refuted and reported as such.

• Python (NumPy
• SciPy
• Monte Carlo)