nx_sha512.nx

sha512.nx -- SHA-512 in pure NishiLang (FIPS 180-4 section 6.4). Canonical: this is the substrate-wide canonical SHA-512 implementation per [[feedback-no-tool-proliferation-bit-level]]. SHA-384 / HMAC-SHA-512 / HKDF-SHA-512 / Argon2id compose THIS file's SHA-512 primitive (SHA-384 is SHA-512 with truncated output + different IV; HMAC adds key wrapping; HKDF adds expand+extract; Argon2id uses BLAKE2b which is separate). Re-implementing the SHA-512 K-table or round function inline is refused. Completes the SHA-2 family alongside sha256.nx. Needed for TLS 1.3 cipher suites that negotiate HMAC-SHA-384 or HMAC-SHA-512 (e.g. TLS_AES_256_GCM_SHA384). SHA-512 is also the natural word width for 64-bit targets -- i64 arithmetic is the primitive, no masking required (contrast sha256.nx's constant M32 masking). Structure mirrors FIPS 180-4 exactly: - 128-byte (1024-bit) blocks - 8 x 64-bit hash state words - 80 rounds with cube-roots-of-primes constants - Merkle-Damgård construction with length-padded final block API: sha512_init(*Sha512) sha512_update(*Sha512, *u8, len) sha512_final(*Sha512, *u8 out64) sha512_digest(*u8 bytes, len, *u8 out64) -- one-shot Context is ~256 bytes: 8 state words + 128-byte buffer + index + bit counter. Caller-allocated. Grover's algorithm under quantum attack: SHA-512 collision resistance halves to 256 bits classical = 128 bits effective against a quantum adversary. Still secure for all practical purposes. Output truncated to 32 bytes yields SHA-512/256 (also FIPS 180-4 Appendix A), useful for shorter tags. license_tier: INDEPENDENT_REDERIVE