Skip to content
AskFlorence
Main Navigation ArchitectureFlorence AIAgentsMembersAgent PlatformValidationInfrastructure

Appearance

Sidebar Navigation

Overview

Home

Glossary

System Architecture

Consumer & Agent Flow

Florence AI

Overview

Principles

Runtime

Tool surface

Adding a tool

Tool registry

Knowledge: SBC scenarios & CSR

Voice

Evals & observability

Provider risk & portability

Outage playbook

Roadmap

Build plan

Agents

Overview

Workflows & pain points

Members

Overview

Medicaid coverage gap

Carriers

Overview

Marketplaces

Overview

Agency

Overview

Regulations

Overview

Agent Platform

Overview

Auth Architecture

MongoDB Permissioning

Compliance Model

Data Models

Data Sources

Overview

CMS Marketplace API

CMS dependency map

PUF Data

State Subsidies

SBE Ingestion Playbook

SBE State Watchouts + Decisions

CA Phase C/D Playbook

NY Phase C/D Playbook

Validation

Overview

Methodology

APTC Formula

California 2026

New York 2026

CAPS Formula

Scenario Results

Infrastructure

Account Inventory

AWS Setup Runbook

AWS Organizations

CloudTrail

GuardDuty

Security Hub

Config

CloudFront + WAFv2

Data sources & ingest

Phase 4 DNS

Change Log

Vulnerability Management

MongoDB Setup

Access Control

Data Classification

Documentation Hosting

Post-deploy Smoke

Development

Preflight (local CI mirror)

Testing strategy

Compliance

Overview (auditor entry point)

SOC 2 Control Mapping

HIPAA Control Mapping

CMS EDE Appendix A Mapping

Risk Assessment

Encryption Policy

Data Retention Policy

Privacy Impact Assessment

Consent Capture & Versioning

Incident Response Plan

Access Control Policy

Marketing vs. Portal Analytics

Vendor / Subprocessor Register

Dependency Vulnerability Policy

BAA / Compliance Evidence

Compliance-Automation Integration

Compliance-Automation Vendor Evaluation

Penetration Test Reports

Architecture

Portal entry handoff

Mobile app strategy

Deferred architecture decisions

Session cookie architecture

Share flows

Decisions (ADRs)

Index

0001 — Atlas project isolation

0002 — Append-only audit log

0003 — Narrow-scoped Mongo users

0004 — Cross-cluster Atlas PrivateLink

0005 — Delayed-job architecture

0006 — Mongo user simplification

0007 — Terraform owns ECS task def

0008 — E2E testing strategy

0009 — Self-hosted analytics + observability (superseded)

0010 — PostHog HIPAA Cloud (supersedes 0009)

Runbooks

Security Incident Response

Break-Glass Root Login

Onboard Team Member

Offboard Team Member

Atlas user provisioning

Deploy via Terraform (ENG-277)

Rollback via Terraform (ENG-277)

S3 data bucket migration (planned Phase 11)

Access Reviews

2026-Q2 Review

Session log

Index

2026-04-23 — Phase 10 DNS cutover

2026-04-22 — Phase 8 prod AWS mirror

2026-04-22 — Phase 7 Atlas VPC peering

2026-04-22 — Phase 6 CloudFront + WAF

2026-04-21 — Phase 5 staging go-live

2026-04-17 — Atlas staging

Briefs

Index

Member portal plan (ENG-187)

2026-04-16/17 handoff

2026-04-17 Atlas handoff

System briefing (2026-04-17)

Creative AdBundance proposal brief

Creative AdBundance analytics brief

ElevenLabs RN integration research

Policies

Overview

On this page

Tier 1 — Zip → County Resolution Audit ​

Last run: April 14, 2026 Duration: 16.2 minutes Total zips: 18,801 CMS calls: 18,930 (with retries) Avg latency: 124 ms Success rate: 99.17%

Purpose ​

Verify our zip_county collection returns the same set of counties as CMS's /counties/by/zip endpoint for every zip in our service area. If a user's zip spans multiple counties, both we and CMS should return the same county options for them to choose from.

Method ​

For each unique zip, query CMS and compare the FIPS code set to ours. Match = same set, regardless of order. Mismatch = any difference (extra counties, missing counties, wrong FIPS).

Results — April 14, 2026 ​

MetricCount%
Exact matches18,41597.95%
County count mismatches3521.87%
CMS errors (max retries)290.15%
Issues to fix3812.03%

Breakdown of mismatches ​

TypeCountDescription
Extra in CMS (we're missing)310CMS returns counties our DB doesn't have for this zip
Extra in ours (CMS doesn't have)59We have counties CMS doesn't return

Missing counties by state ​

Most concentrated in:

StateMissing zips
AL143
NC77
SC33
FL13
TX12
AK10
SD9
NE7
WY6
AZ6
OR6
Others30

Root cause analysis ​

Type 1: Cross-state border zips (most "extra in ours") ​

Examples:

  • 21912 (MD): we have DE 10003 entry, CMS doesn't return DE for this zip
  • 21874 (MD): we have DE 10005 entry, CMS doesn't return DE for this zip

Why: During the CMS enrichment sweep, we asked CMS about every zip, including ones near state borders. CMS sometimes returned multiple states. We stored those, but CMS doesn't always return the same set when re-queried.

Action: Cross-state entries for non-service-area states already deleted. Remaining cross-state entries within our 30 federal states are flagged for cleanup.

Type 2: AL/NC/SC missing border counties (most "extra in CMS") ​

Examples:

  • 27249 (NC): missing 37001, 37033, 37157
  • 27265 (NC): missing 37057, 37067
  • 30165 (GA-bordering): we have AL 01019 but missing GA counties

Why: Our enrichment captured the primary county per zip but missed secondary counties for zips that span 3+ counties. The original CMS sweep had query-result limits.

Action: Run scripts/db/fix-tier-1-gaps.js to query CMS and add missing entries.

Type 3: CMS errors (29 zips) ​

All "max retries exceeded" — CMS API timeouts. These zips should be retried in a follow-up pass.

Action plan ​

  1. Run scripts/db/fix-tier-1-gaps.js — re-query CMS for the 352 mismatched zips and reconcile
  2. Re-run Tier 1 — verify match rate ≥99.5%
  3. Document remaining residual — any zips that still don't match get individual investigation

Production impact ​

The 310 "missing in ours" zips affect users whose zip spans 2+ counties — they'll see fewer county options in the picker than they should. This is a user-facing functional gap but doesn't produce wrong premiums (if they pick the right county, the rest of the flow is correct).

The 59 "extra in ours" zips are mostly cross-state border noise. Users would see counties from states we don't serve, which would fail at the plan search step. Functional impact: minor confusion, no wrong data.

CMS API stats ​

total: 18930
success: 18772
retried: 158 (backoff events)
failed: 29
avgLatencyMs: 124
successRate: 99.17%
Pager
Next pageHome

AskFlorence Internal Documentation. Not for public distribution.

AskFlorence

Internal Documentation

Access restricted. Not for public distribution.