One method could be to have a replay system, public state snapshots, and publicly logged inputs. Servers could randomly audit federated peers by replaying small segments of their logs, and defederate/broadcast that there is a problem if the end state doesn’t match. This would require them to be running the same code and not use arbitrary mods, but different settings would still be possible.

From talking to someone involved in local government software, it seemed to me like there is a push in the opposite direction from that; they want and are moving towards offloading as much as possible to third party software vendors.