Summary

1. Type: deterministic comparison (fixture-order)
2. Scope: test-only; no production changes
3. Module: jbpm-services/jbpm-kie-services
4. Tests:
   • org.jbpm.kie.services.test.ProcessServiceWithVariableTagsTest#testStartProcessWithRestrictedVariable
   • org.jbpm.kie.services.test.ProcessServiceWithVariableTagsTest#testStartProcessWithViolatedRestrictedVariable

Root Cause
DeploymentDescriptorImpl#toXml() materializes kie-deployment-descriptor.xml from unordered collections. Under NonDex the iteration order shuffles, producing a descriptor whose top-level XML element order violates the schema. This throws a MarshalException during @Before prepare() before either test executes, making both methods flaky for the same reason.

Fix
Inject a static, deterministic kie-deployment-descriptor.xml as an extra test resource and disable dynamic descriptor generation. The XML preserves original semantics (same persistence/audit units, runtime strategy SINGLETON, and the same VariableGuardProcessEventListener("admin", identityProvider)), so assertions and scenarios remain unchanged while ordering becomes stable.

Validation

1. Local unit suite remains stable
2. NonDex randomized execution (100 runs) passes with zero failures

Risk
Low. Fixture-only change; no production impact. Descriptor behavior and test assertions are preserved, with deterministic ordering guaranteed.