We have gone through the same requirment, we also couldn't rely on the rest API
Our solution was to wrap the core engine as an EAR and provide a facade which wraps all the methods for accessing/managing session ,process instances , tasks and history service (db logs ) . Then we are providing a webservice interface to this facade, so that this is accessible to external applications.
Hope this bit of information is helpful.
Cheers :)