We have jBPM engine embedded in our service, but it is a general problem.

In addition to the process definition, our kjar also contains some java classes.
When we deploy a kjar to the jBPM engine KModuleDeploymentService.deploy(DeploymentUnit unit) is called and then implicitly
processResources(...). Inside this method, for java classes, addClassToDeployedUnit(...) is called.

Here it is checked for DeploymentDescriptor.getLimitSerializationClasses()

Boolean limitClasses = true;
if (unit != null) {
  DeploymentDescriptor depDesc = ((KModuleDeploymentUnit) unit).getDeploymentDescriptor();
  if (depDesc != null) {
    limitClasses = depDesc.getLimitSerializationClasses();
     }
}

 According to the documentation, we can control this with 'limit-serialization-classes' inside kie-deployment-descriptor.xml.

The problem is that kie-deployment-descriptor.xml is read a couple of lines below, when the classes and dependencies are already processed - RuntimeEnvironmentBuilder builder = boostrapRuntimeEnvironmentBuilder(...)

So when calling addClassToDeployedUnit this setting has no effect and classes without annotations are not added.

Consequently, during process execution, the call to DeploymentService().getDeployedUnit("deploymentId").getDeployedClasses() always returns an empty list. We would expect it to return a list of our kjar classes.