diff --git a/ayanova/devdocs/todo.txt b/ayanova/devdocs/todo.txt
index 33aab8d1..0df9900a 100644
--- a/ayanova/devdocs/todo.txt
+++ b/ayanova/devdocs/todo.txt
@@ -11,7 +11,11 @@ Useful links:
 	Report templates pre-designed and open source: https://github.com/wildbit/postmark-templates
 	Example jsreport designer: https://playground.jsreport.net/w/admin/dI2_fUqZ
 
-	TODO: Where is the data coming from for the reports?
+	todo: Code minimal backend server stuff to get to front end stuff
+	todo: code front end enough to see if need standalone designer or not (does it bloat the package needlessly?)
+	todo: iterate back and forth between back and front, get to basic ability to report off widget and go from there
+
+	PLAN: DATA SOURCE
 		Can report off single object or DataList, but then datalist isn't all the fields of the object.
 		Was thinking it gets sent by the client back to the server but that's bandwidth wasteful
 		in v7 reports are basically designed arounda  single object but accomodate multiple and it's same fields?
@@ -30,11 +34,56 @@ Useful links:
 				So widget for report is mirror of widget but also includes resolved linked data, for example the user name for the userid field
 					I'm thinking ideally it keeps the id as well because it may be useful for report work to have the source id and be able to fetch the user record for example and populate something
 				Report widget is a superset of biz object widget
+				Does the report Widget have a full User record or just the name?
+					I'm thinking this is case by case, some objects will clearly need more data from related objects particularly workorders etc
+				So biz object has report form DTO basically that is returned based on a single or list of id's in an array always
+				Since data is wrangled only at the server nothing wastes bandwidth, it's up to the report designer to include or not fields and they will only get sent if in the report with the rendered report
+			SECURITY:
+				This one is tough, I guess the rights flow from the biz object on a direct request but when reporting off a notification I guess it needs to check rights at the moment of processing the report
+
+		ACTUAL:
+			All data sources are arrays by default.  If it's a single object then it's a single record array.
+			Every report is intended to be single or multiple, up to designer but the same data gets fed either way
+			Every AyaType has a superset report dto object that contains all the regular object fields but also extra as required for reporting
+				linked object id's are populate with names in display format or whatever makes sense for that object
+			Biz objects have a standard interfaced GetReportData method that accepts an array of id's and returns an array of actualized data for reporting / export etc
+				All done without security, it's the report render routes responsibility to check that for the situation of the request
+
+	PLAN: REPORT TEMPLATE
+		ACTUAL:
+		DB Fields
+			id
+			allowedroles (roles value for all roles allowed to view this report, defaults to ALL unless they set more restrictive)
+			aytype (Type report is designed to handle and offered in UI for areas of that type),
+			content (text unlimited, html source markup, not null, can reference external libs maybe or curated list of local ones?), 
+			css (text unlimited, css passed to report, null ok),
+			jsprerender (javascript for modifying data in advance of rendering, prerender function is called there can be other functions it calls no problem), 
+			jshelpers (javascript helper functions all passed to handlebars before processing),			
+			rendertype (type to render, default is pdf, but could be text, csv etc),
+			*tentative locale (browser locale to be set for processing, default locale? tentative here as well, need to see what can be done / is needed, leverage ayanova client code already written)
+			*tenative header, footer (text unlimited html source markup, can be null),
+			*tentative precomp (text, precompiled template if turns out to be excessivly slow to compile on the fly)
+
+	PLAN: RENDER
+		Both a route (for external calls) that returns a report and an internal biz object that is used by notification for the same purpose
+			so the route just calls the biz object which handles processing, getting data, checking rights and then making the report and either attaching it to an email (maybe I do need that temp server folder after all) 
+			or return to route to return to Client end
+		ACTUAL:
+		ReportController, ReportBiz
 		
-		
-	TODO: Enough UI to get started testing reporting and seeing what features need to be added and where
+	TODO: LOCALIZATION
+		This should be a display function, nothing to do with source data which is provided unaltered to the report scripts to display as they wish
+		Maybe a set of the smallest most used js libs for formatting for display (already made HB helpers?)
+	
+	TODO: CUSTOM FIELDS WIDGET for reporting that can produce a result from the custom fields object that is suitable for easy reporting
+
+
+
+	TODO: REPORT DESIGNER / RENDER ROUTE / WIDGET OBJECT
+		Enough UI to get started testing reporting and seeing what features need to be added and where
 		Render route, pass data, design report
 		replicate the jsreport designer as much as necessary for our purposes but don't get ahead of things, do it incrementally
+		also look at v7 reprot designer for ideas