An append-only, hash-chained audit log in SQLite, and a script to check it

How Styx records every access request, grant, use and revoke in a log the database refuses to edit, and how to verify the chain yourself.