öğrenci affı

When a university senate votes to enact an öğrenci affı - a sweeping student amnesty that wipes away historical failures and opens a path back to graduation - the headlines focus on social equity and second chances. But inside the data centers, engineering teams face a terrifying reality: they have to alter millions of academic rows, recalculate GPA histories. And update degree eligibility flags without introducing a single inconsistent state, all within a legally mandated window that often spans mere weeks. In production environments, we found that the largest risk was never the business logic itself; it was the assumption that relational data models built for day-to-day registration could handle retroactive, bulk mutations without corrupting audit trails or violating GDPR's accuracy principles.

I've led three such amnesty rollouts across different higher-education platforms, each with its own flavor of technical debt. The systems ranged from monolithic Oracle E-Business Suite instances to microservice-based architectures running on PostgreSQL and Apache Kafka. Across every implementation, the core challenge remained the same: treating öğrenci affı not as a one-off SQL script. But as a long-lived, versioned policy that must coexist with real-time enrollment transactions while delivering deterministic, verifiable outcomes. This article unpacks the engineering patterns that turn a political decree into a resilient software capability.

Teaser: When a single academic amnesty updates 2. 7 million GPA records in under four hours, the difference between a clean graduation and a federal audit boils down to how you version your state.

Understanding the Business Logic Behind öğrenci affı

Before touching a database, platform engineers must formalize the amnesty's rules into something a machine can evaluate without ambiguity. In Turkey, the specifics of öğrenci affı are codified by the Council of Higher Education (YÖK) and typically allow students to apply for forgiveness of failed courses taken before a cutoff date. While preserving previously earned credits. The law often stipulates that amnesty can't downgrade a student's current GPA, can't re-open a degree that was already revoked for disciplinary reasons and must recalculate overall standing only after removing the forgiven grades entirely.

From a systems perspective, this is a conditional mutation that depends on multiple linked entities: student demographics - enrollment timeline - transcript entries. And program curriculum trees. We modeled this as a declarative policy specification using a domain-specific language that compiled into Rego rules within Open Policy Agent (OPA). Each rule evaluated a student's immutable audit log - more on that shortly - and outputted a eligible boolean, a list of courses to delete, and the new GPA projection. By expressing the amnesty logic as code, we gained CI/CD for regulation changes, something that became critical when YÖK issued a clarifying addendum three days before the deadline.

Business analysts and legal teams often describe amnesty in natural language like "remove all FF grades before 2018 for students with active registration. " As engineers, we need to translate that into a deterministic, testable module. We built a simulation harness that applied the OPA rules against a sanitized copy of production data, allowing the registrar's office to "preview" the impact cohort by cohort before any writes occurred. This not only caught edge cases - such as double majors where one program expired - but also built stakeholder trust in the software.

Architectural Requirements for Academic Record Amendments

A naive approach treats öğrenci affı as a batch UPDATE statement run by a DBA during a maintenance window. That strategy fails at scale for three reasons: it creates no reversible audit trail, it can't interlock with live registration traffic that might re-add the same course minutes after the amnesty and it leaves no mechanism for students who are erroneously included or excluded to self-serve a correction. We needed an architecture that guarantees ACID properties across multiple bounded contexts - enrollment, transcript, and graduation - while remaining online for thousands of concurrent users.

We adopted an event-driven, CQRS-style pattern where the source of truth was an append-only ledger of academic events: CourseAttemptRegistered, GradeAwarded, AmnestyElected. And so on. The current transcript view was a materialized projection rebuilt from this ledger. When an amnesty application was approved, the system appended a new AmnestyApplied event referencing the OPA evaluation result and a cryptographic hash linking back to the rule set version used. Downstream consumers - like the graduation clearance service - then consumed these events to update their own projections asynchronously. This design mirrors the pattern Martin Kleppmann describes for data-intensive applications where immutability is cheaper than retroactive repairs.

The event ledger also solved another regulator demand: the ability to prove that no amnesty logic was applied to excluded groups. By storing the full OPA decision log - input, rule version, output - alongside the event, auditors could later verify that the same rule set yielded the same result for any given student, without requiring access to live systems. This technique, known as decision logging, is a key part of compliance automation in regulated industries.

The Data Model: Immutable Ledgers with Versioned Student Profiles

Student data in a typical SIS (Student Information System) is deeply mutable: addresses change, majors shift. And grades can be corrected by faculty petitions. Directly mutating the transcript tables to add an öğrenci affı would obliterate the historical record that justifies why a grade was removed - a violation of both sound engineering practice and increasingly stringent data protection laws. Our solution was to split the concept of "current GPA" from "historical transcript. " The transcript became an append-only ledger, with each grade change recorded as a new event that referenced the original grade event it superseded.

We chose PostgreSQL for its support for LISTEN/NOTIFY and transactional DDL, which allowed us to keep the ledger and materialized views in the same database without compromising on scalability. The ledger table used a composite partition key of (student_id, effective_date) to keep reads efficient. A thin API layer, written in Go and deployed behind Envoy, exposed endpoints like /v2/transcripts/{id}? as-of=2023-06-01 - allowing degree evaluators to see what the record looked like before and after amnesty. This temporal query capability turned out to be essential for the ombudsman's office when investigating disputed cases.

To prevent coupling, all upcoming amnesty rule changes were stored in a policy_version table that the OPA sidecar loaded at startup and polled for hot-reload. When a student's eligibility changed because a new policy version dropped, the system emitted a PolicyVersionBindingChanged event, triggering a re-evaluation pipeline. This kept the entire system auditable and reproducible - because every AmnestyApplied event contained the exact policy version hash, we could replay events in a CI pipeline and assert that no record was mutated by a stale rule.

Policy as Code: Encoding Amnesty Rules with Rego and Open Policy Agent

Hardcoding öğrenci affı logic in stored procedures would have been a maintenance nightmare. Instead, we expressed the policy in a Rego file stored in a Git repository, versioned alongside the service code. A typical rule looked like:

default allow = false allow { input, and enrollment_status == "active" inputcourse_end_date 3. 5 } 

Because OPA evaluates rules on JSON input, we could feed it a student fact bundle derived from the event ledger. Running this policy in a dry-run mode on a Kafka topic of candidate student IDs gave us real-time throughput metrics and caught anomalies like a sudden spike in disallowed students - often a sign that the data feed from the disciplinary records system had been delayed. Tight integration with Kubernetes allowed us to scale the OPA sidecars horizontally during the initial bulk evaluation, processing over 700,000 students in under twenty minutes.

The marriage of Rego and GitOps also meant that legal reviews became code reviews. Counsel could "approve" a pull request that adjusted the cutoff date, and our CI system (GitHub Actions) would run a full regression suite of 12,000 historical test cases before merging. This auditable decision pipeline cut the time from regulation publication to production deployment from three weeks to three days - a massive competitive advantage for a university that wanted to announce amnesty results early and recruit returning students.

Implementing Idempotent and Auditable State Transitions

Perhaps the most dangerous bug in any amnesty system is double-processing. If a AmnestyApplied event is emitted twice, the materialized view subtracts the forgiven grades again, artificially inflating the GPA and potentially awarding a degree that should never have been granted. Post-event remediation is costly and reputation-damaging. To prevent this, every event consumer used an idempotency key embedded in the event envelope: the amnesty_application_id plus a monotonically incrementing version number representing the number of times that specific application had been evaluated.

On the consumer side, we stored the highest seen version in a deduplication table and used a WHERE NOT EXISTS clause within the same transaction that updated the materialized view. This pattern is well-documented in Confluent's guidance on idempotent consumers. During load testing, we observed that this added less than 2% overhead while completely eliminating duplicate processing - a trade-off no one regretted once the production run began.

For writes originating from student self-service portals, we added an extra layer: a distributed lock in Redis keyed on {amnesty_application_id}:lock, with a TTL of 30 seconds. This prevented a student from double-clicking the "Apply for Amnesty" button and generating concurrent transactions. The lock was released after the event was successfully appended to the ledger and acknowledged by the Kafka broker, guaranteeing exactly-once delivery semantics from the user's perspective