[#651] engine/test: Speedup StorageEngine_Inhume

Signed-off-by: Alexander Chuprov <a.chuprov@yadro.com>

.docker/Dockerfile.adm

@@ -1,4 +1,4 @@
-FROM golang:1.18 as builder
+FROM golang:1.21 as builder
 ARG BUILD=now
 ARG VERSION=dev
 ARG REPO=repository

.docker/Dockerfile.ci

@@ -1,4 +1,4 @@
-FROM golang:1.19
+FROM golang:1.21
 
 WORKDIR /tmp
 

.docker/Dockerfile.cli

@@ -1,4 +1,4 @@
-FROM golang:1.18 as builder
+FROM golang:1.21 as builder
 ARG BUILD=now
 ARG VERSION=dev
 ARG REPO=repository

.docker/Dockerfile.ir

@@ -1,4 +1,4 @@
-FROM golang:1.18 as builder
+FROM golang:1.21 as builder
 ARG BUILD=now
 ARG VERSION=dev
 ARG REPO=repository

.docker/Dockerfile.storage

@@ -1,4 +1,4 @@
-FROM golang:1.18 as builder
+FROM golang:1.21 as builder
 ARG BUILD=now
 ARG VERSION=dev
 ARG REPO=repository

.docker/Dockerfile.storage-testnet

@@ -1,19 +0,0 @@
-FROM golang:1.18 as builder
-ARG BUILD=now
-ARG VERSION=dev
-ARG REPO=repository
-WORKDIR /src
-COPY . /src
-
-RUN make bin/frostfs-node
-
-# Executable image
-FROM alpine AS frostfs-node
-RUN apk add --no-cache bash
-
-WORKDIR /
-
-COPY --from=builder /src/bin/frostfs-node /bin/frostfs-node
-COPY --from=builder /src/config/testnet/config.yml /config.yml
-
-CMD ["frostfs-node", "--config", "/config.yml"]

.forgejo/workflows/build.yml

@@ -0,0 +1,41 @@
+name: Build
+
+on: [pull_request]
+
+jobs:
+  build:
+    name: Build Components
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go_versions: [ '1.20', '1.21' ]
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          # Allows to fetch all history for all branches and tags.
+          # Need this for proper versioning.
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '${{ matrix.go_versions }}'
+
+      - name: Build CLI
+        run: make bin/frostfs-cli
+      - run: bin/frostfs-cli --version
+
+      - name: Build NODE
+        run: make bin/frostfs-node
+
+      - name: Build IR
+        run: make bin/frostfs-ir
+
+      - name: Build ADM
+        run: make bin/frostfs-adm
+      - run: bin/frostfs-adm --version
+
+      - name: Build LENS
+        run: make bin/frostfs-lens
+      - run: bin/frostfs-lens --version

.forgejo/workflows/dco.yml

@@ -0,0 +1,21 @@
+name: DCO action
+on: [pull_request]
+
+jobs:
+  dco:
+    name: DCO
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.21'
+
+      - name: Run commit format checker
+        uses: https://git.frostfs.info/TrueCloudLab/dco-go@v2
+        with:
+          from: 'origin/${{ github.event.pull_request.base.ref }}'

.forgejo/workflows/tests.yml

@@ -0,0 +1,73 @@
+name: Tests and linters
+on: [pull_request]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.21'
+          cache: true
+
+      - name: Install linters
+        run: make lint-install
+
+      - name: Run linters
+        run: make lint
+
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go_versions: [ '1.20', '1.21' ]
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '${{ matrix.go_versions }}'
+          cache: true
+
+      - name: Run tests
+        run: make test
+
+  tests-race:
+    name: Tests with -race
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.21'
+          cache: true
+
+      - name: Run tests
+        run: go test ./... -count=1 -race
+
+  staticcheck:
+    name: Staticcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.21'
+          cache: true
+
+      - name: Install staticcheck
+        run: make staticcheck-install
+
+      - name: Run staticcheck
+        run: make staticcheck-run

.forgejo/workflows/vulncheck.yml

@@ -0,0 +1,22 @@
+name: Vulncheck
+on: [pull_request]
+
+jobs:
+  vulncheck:
+    name: Vulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.21'
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...

.gitattributes

@@ -1,2 +1,3 @@
 /**/*.pb.go -diff -merge
 /**/*.pb.go linguist-generated=true
+/go.sum -diff

.golangci.yml

@@ -4,7 +4,7 @@
 # options for analysis running
 run:
   # timeout for analysis, e.g. 30s, 5m, default is 1m
-  timeout: 10m
+  timeout: 20m
 
   # include test files or not, default is true
   tests: false
@@ -31,6 +31,21 @@ linters-settings:
     statements: 60 # default 40
   gocognit:
     min-complexity: 40 # default 30
+  importas:
+    no-unaliased: true
+    no-extra-aliases: false
+    alias:
+      pkg: git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object
+      alias: objectSDK
+  custom:
+    truecloudlab-linters:
+      path: bin/linters/external_linters.so
+      original-url: git.frostfs.info/TrueCloudLab/linters.git
+      settings:
+        noliteral:
+          target-methods : ["reportFlushError", "reportError"]
+          disable-packages: ["codes", "err", "res","exec"]
+          constants-package: "git.frostfs.info/TrueCloudLab/frostfs-node/internal/logs"
 
 linters:
   enable:
@@ -62,5 +77,7 @@ linters:
     - funlen
     - gocognit
     - contextcheck
+    - importas
+    - truecloudlab-linters
   disable-all: true
   fast: false

.pre-commit-config.yaml

@@ -26,14 +26,17 @@ repos:
       exclude: ".key$"
 
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.9.0.2
+    rev: v0.9.0.5
     hooks:
       - id: shellcheck
 
-  - repo: https://github.com/golangci/golangci-lint
-    rev: v1.51.2
+  - repo: local
     hooks:
-      - id: golangci-lint
+      - id: make-lint
+        name: Run Make Lint
+        entry: make lint
+        language: system
+        pass_filenames: false
 
   - repo: local
     hooks:
@@ -44,7 +47,17 @@ repos:
          types: [go]
          language: system
 
+  - repo: local
+    hooks:
+       - id: gofumpt
+         name: gofumpt
+         entry: make fumpt
+         pass_filenames: false
+         types: [go]
+         language: system
+
   - repo: https://github.com/TekWizely/pre-commit-golang
     rev: v1.0.0-rc.1
     hooks:
        - id: go-staticcheck-repo-mod
+       - id: go-mod-tidy

CHANGELOG.md

@@ -4,10 +4,46 @@ Changelog for FrostFS Node
 ## [Unreleased]
 
 ### Added
+- Support impersonate bearer token (#229)
+- Change log level on SIGHUP for ir (#125)
+- Reload pprof and metrics on SIGHUP for ir (#125)
+- Support copies number parameter in `frostfs-cli object put` (#351)
+- Set extra wallets on SIGHUP for ir (#125)
+- Writecache metrics (#312)
+- Add tree service metrics (#370)
+
 ### Changed
+- `frostfs-cli util locode generate` is now much faster (#309)
 ### Fixed
+- Take network settings into account during netmap contract update (#100)
+- Read config files from dir even if config file not provided via `--config` for node (#238)
+- Notary requests parsing according to `neo-go`'s updates (#268)
+- Tree service panic in its internal client cache (#322)
+- Iterate over endpoints when create ws client in morph's constructor (#304)
+- Delete complex objects with GC (#332)
+
 ### Removed
 ### Updated
+- `neo-go` to `v0.101.1`
+- `google.golang.org/grpc` to `v1.55.0`
+- `paulmach/orb` to `v0.9.2`
+- `go.etcd.io/bbolt` to `v1.3.7`
+- `github.com/nats-io/nats.go` to `v1.25.0`
+- `golang.org/x/sync` to `v0.2.0`
+- `golang.org/x/term` to `v0.8.0`
+- `github.com/spf13/cobra` to `v1.7.0`
+- `github.com/panjf2000/ants/v2` `v2.7.4`
+- `github.com/multiformats/go-multiaddr` to `v0.9.0`
+- `github.com/hashicorp/golang-lru/v2` to `v2.0.2`
+- `go.uber.org/atomic` to `v1.11.0`
+- Minimum go version to v1.20
+- `github.com/prometheus/client_golang` to `v1.15.1`
+- `github.com/prometheus/client_model` to `v0.4.0`
+- `go.opentelemetry.io/otel` to `v1.15.1`
+- `go.opentelemetry.io/otel/trace` to `v1.15.1`
+- `github.com/spf13/cast` to `v1.5.1`
+- `git.frostfs.info/TrueCloudLab/hrw` to `v1.2.1`
+
 ### Updating from v0.36.0
 
 ## [v0.36.0] - 2023-04-12 - Furtwängler
@@ -25,6 +61,7 @@ Changelog for FrostFS Node
 - Parameters `nns-name` and `nns-zone` for command `frostfs-cli container create` (#37)
 - Tree service now saves the last synchronization height which persists across restarts (#82)
 - Add tracing support (#135)
+- Multiple (and a fix for single) copies number support for `PUT` requests (#221)
 
 ### Changed
 - Change `frostfs_node_engine_container_size` to counting sizes of logical objects
@@ -64,6 +101,9 @@ Changelog for FrostFS Node
 - Iterating over just removed files by FSTree (#98)
 - Parts of a locked object could not be removed anymore (#141)
 - Non-alphabet nodes do not try to handle alphabet events (#181)
+- Failing SN and IR transactions because of incorrect scopes (#2230, #2263)
+- Global scope used for some transactions (#2230, #2263)
+- Concurrent morph cache misses (#30)
 
 ### Removed
 ### Updated

CONTRIBUTING.md

@@ -3,8 +3,8 @@
 First, thank you for contributing! We love and encourage pull requests from
 everyone. Please follow the guidelines:
 
-- Check the open [issues](https://github.com/TrueCloudLab/frostfs-node/issues) and
-  [pull requests](https://github.com/TrueCloudLab/frostfs-node/pulls) for existing
+- Check the open [issues](https://git.frostfs.info/TrueCloudLab/frostfs-node/issues) and
+  [pull requests](https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls) for existing
   discussions.
 
 - Open an issue first, to discuss a new feature or enhancement.
@@ -27,19 +27,19 @@ Start by forking the `frostfs-node` repository, make changes in a branch and the
 send a pull request. We encourage pull requests to discuss code changes. Here
 are the steps in details:
 
-### Set up your GitHub Repository
-Fork [FrostFS node upstream](https://github.com/TrueCloudLab/frostfs-node/fork) source
+### Set up your Forgejo repository
+Fork [FrostFS node upstream](https://git.frostfs.info/TrueCloudLab/frostfs-node) source
 repository to your own personal repository. Copy the URL of your fork (you will
 need it for the `git clone` command below).
 
 ```sh
-$ git clone https://github.com/TrueCloudLab/frostfs-node
+$ git clone https://git.frostfs.info/TrueCloudLab/frostfs-node
 ```
 
 ### Set up git remote as ``upstream``
 ```sh
 $ cd frostfs-node
-$ git remote add upstream https://github.com/TrueCloudLab/frostfs-node
+$ git remote add upstream https://git.frostfs.info/TrueCloudLab/frostfs-node
 $ git fetch upstream
 $ git merge upstream/master
 ...
@@ -58,7 +58,7 @@ $ git checkout -b feature/123-something_awesome
 After your code changes, make sure
 
 - To add test cases for the new code.
-- To run `make lint`
+- To run `make lint` and `make staticcheck-run`
 - To squash your commits into a single commit or a series of logically separated
   commits run `git rebase -i`. It's okay to force update your pull request.
 - To run `make test` and `make all` completes.
@@ -89,8 +89,8 @@ $ git push origin feature/123-something_awesome
 ```
 
 ### Create a Pull Request
-Pull requests can be created via GitHub. Refer to [this
-document](https://help.github.com/articles/creating-a-pull-request/) for
+Pull requests can be created via Forgejo. Refer to [this
+document](https://docs.codeberg.org/collaborating/pull-requests-and-git-flow/) for
 detailed steps on how to create a pull request. After a Pull Request gets peer
 reviewed and approved, it will be merged.
 

Makefile

@@ -7,8 +7,17 @@ VERSION ?= $(shell git describe --tags --dirty --match "v*" --always --abbrev=8
 HUB_IMAGE ?= truecloudlab/frostfs
 HUB_TAG ?= "$(shell echo ${VERSION} | sed 's/^v//')"
 
-GO_VERSION ?= 1.19
-LINT_VERSION ?= 1.50.0
+GO_VERSION ?= 1.21
+LINT_VERSION ?= 1.54.0
+TRUECLOUDLAB_LINT_VERSION ?= 0.0.2
+PROTOC_VERSION ?= 25.0
+PROTOC_GEN_GO_VERSION ?= $(shell go list -f '{{.Version}}' -m google.golang.org/protobuf)
+PROTOGEN_FROSTFS_VERSION ?= $(shell go list -f '{{.Version}}' -m git.frostfs.info/TrueCloudLab/frostfs-api-go/v2)
+PROTOC_OS_VERSION=osx-x86_64
+ifeq ($(shell uname), Linux)
+	PROTOC_OS_VERSION=linux-x86_64
+endif
+STATICCHECK_VERSION ?= 2023.1.6
 ARCH = amd64
 
 BIN = bin
@@ -25,7 +34,17 @@ PKG_VERSION ?= $(shell echo $(VERSION) | sed "s/^v//" | \
 			sed -E "s/(.*)-(g[a-fA-F0-9]{6,8})(.*)/\1\3~\2/" | \
 			sed "s/-/~/")-${OS_RELEASE}
 
-.PHONY: help all images dep clean fmts fmt imports test lint docker/lint
+OUTPUT_LINT_DIR ?= $(abspath $(BIN))/linters
+LINT_DIR = $(OUTPUT_LINT_DIR)/golangci-lint-$(LINT_VERSION)-v$(TRUECLOUDLAB_LINT_VERSION)
+TMP_DIR := .cache
+PROTOBUF_DIR ?= $(abspath $(BIN))/protobuf
+PROTOC_DIR ?= $(PROTOBUF_DIR)/protoc-v$(PROTOC_VERSION)
+PROTOC_GEN_GO_DIR ?= $(PROTOBUF_DIR)/protoc-gen-go-$(PROTOC_GEN_GO_VERSION)
+PROTOGEN_FROSTFS_DIR ?= $(PROTOBUF_DIR)/protogen-$(PROTOGEN_FROSTFS_VERSION)
+STATICCHECK_DIR ?= $(abspath $(BIN))/staticcheck
+STATICCHECK_VERSION_DIR ?= $(STATICCHECK_DIR)/$(STATICCHECK_VERSION)
+
+.PHONY: help all images dep clean fmts fumpt imports test lint docker/lint
 		prepare-release debpackage pre-commit unpre-commit
 
 # To build a specific binary, use it's name prefix with bin/ as a target
@@ -65,24 +84,40 @@ dep:
 	CGO_ENABLED=0 \
 	go mod tidy -v && echo OK
 
+# Build export-metrics
+export-metrics: dep
+	@printf "⇒ Build export-metrics\n"
+	CGO_ENABLED=0 \
+	go build -v -trimpath -o bin/export-metrics ./scripts/export-metrics
+
 # Regenerate proto files:
 protoc:
-	@GOPRIVATE=github.com/TrueCloudLab go mod vendor
-	# Install specific version for protobuf lib
-	@go list -f '{{.Path}}/...@{{.Version}}' -m  github.com/golang/protobuf | xargs go install -v
-	@GOBIN=$(abspath $(BIN)) go install -mod=mod -v git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/util/protogen
-	# Protoc generate
-	@for f in `find . -type f -name '*.proto' -not -path './vendor/*'`; do \
+	@if [ ! -d "$(PROTOC_DIR)" ] || [ ! -d "$(PROTOC_GEN_GO_DIR)" ] || [ ! -d "$(PROTOGEN_FROSTFS_DIR)" ]; then \
+		make protoc-install; \
+	fi
+	@for f in `find . -type f -name '*.proto' -not -path './bin/*'`; do \
 		echo "⇒ Processing $$f "; \
-		protoc \
-			--proto_path=.:./vendor:/usr/local/include \
-			--plugin=protoc-gen-go-frostfs=$(BIN)/protogen \
+		$(PROTOC_DIR)/bin/protoc \
+			--proto_path=.:$(PROTOC_DIR)/include:/usr/local/include \
+			--plugin=protoc-gen-go=$(PROTOC_GEN_GO_DIR)/protoc-gen-go \
+			--plugin=protoc-gen-go-frostfs=$(PROTOGEN_FROSTFS_DIR)/protogen \
 			--go-frostfs_out=. --go-frostfs_opt=paths=source_relative \
 			--go_out=. --go_opt=paths=source_relative \
 			--go-grpc_opt=require_unimplemented_servers=false \
 			--go-grpc_out=. --go-grpc_opt=paths=source_relative $$f; \
 	done
-	rm -rf vendor
+
+protoc-install:
+	@rm -rf $(PROTOBUF_DIR)
+	@mkdir $(PROTOBUF_DIR)
+	@echo "⇒ Installing protoc... "
+	@wget -q -O $(PROTOBUF_DIR)/protoc-$(PROTOC_VERSION).zip 'https://github.com/protocolbuffers/protobuf/releases/download/v$(PROTOC_VERSION)/protoc-$(PROTOC_VERSION)-$(PROTOC_OS_VERSION).zip'
+	@unzip -q -o $(PROTOBUF_DIR)/protoc-$(PROTOC_VERSION).zip -d $(PROTOC_DIR)
+	@rm $(PROTOBUF_DIR)/protoc-$(PROTOC_VERSION).zip
+	@echo "⇒ Installing protoc-gen-go..."
+	@GOBIN=$(PROTOC_GEN_GO_DIR) go install -v google.golang.org/protobuf/...@$(PROTOC_GEN_GO_VERSION)
+	@echo "⇒ Instaling protogen FrostFS plugin..."
+	@GOBIN=$(PROTOGEN_FROSTFS_DIR) go install -mod=mod -v git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/util/protogen@$(PROTOGEN_FROSTFS_VERSION)
 
 # Build FrostFS component's docker image
 image-%:
@@ -95,7 +130,7 @@ image-%:
 		-t $(HUB_IMAGE)-$*:$(HUB_TAG) .
 
 # Build all Docker images
-images: image-storage image-ir image-cli image-adm image-storage-testnet
+images: image-storage image-ir image-cli image-adm
 
 # Build dirty local Docker images
 dirty-images: image-dirty-storage image-dirty-ir image-dirty-cli image-dirty-adm
@@ -111,33 +146,56 @@ docker/%:
 
 
 # Run all code formatters
-fmts: fmt imports
-
-# Reformat code
-fmt:
-	@echo "⇒ Processing gofmt check"
-	@gofmt -s -w cmd/ pkg/ misc/
+fmts: fumpt imports
 
 # Reformat imports
 imports:
 	@echo "⇒ Processing goimports check"
 	@goimports -w cmd/ pkg/ misc/
 
+fumpt:
+	@echo "⇒ Processing gofumpt check"
+	@gofumpt -l -w cmd/ pkg/ misc/
+
 # Run Unit Test with go test
 test:
 	@echo "⇒ Running go test"
-	@go test ./...
+	@go test ./... -count=1
 
 pre-commit-run:
 	@pre-commit run -a --hook-stage manual
 
+# Install linters
+lint-install:
+	@rm -rf $(OUTPUT_LINT_DIR)
+	@mkdir $(OUTPUT_LINT_DIR)
+	@mkdir -p $(TMP_DIR)
+	@rm -rf $(TMP_DIR)/linters
+	@git -c advice.detachedHead=false clone --branch v$(TRUECLOUDLAB_LINT_VERSION) https://git.frostfs.info/TrueCloudLab/linters.git $(TMP_DIR)/linters
+	@@make -C $(TMP_DIR)/linters lib CGO_ENABLED=1 OUT_DIR=$(OUTPUT_LINT_DIR)
+	@rm -rf $(TMP_DIR)/linters
+	@rmdir $(TMP_DIR) 2>/dev/null || true
+	@CGO_ENABLED=1 GOBIN=$(LINT_DIR) go install github.com/golangci/golangci-lint/cmd/golangci-lint@v$(LINT_VERSION)
+
 # Run linters
 lint:
-	@golangci-lint --timeout=5m run
+	@if [ ! -d "$(LINT_DIR)" ]; then \
+		make lint-install; \
+	fi
+	$(LINT_DIR)/golangci-lint run
+
+# Install staticcheck
+staticcheck-install:
+	@rm -rf $(STATICCHECK_DIR)
+	@mkdir $(STATICCHECK_DIR)
+	@GOBIN=$(STATICCHECK_VERSION_DIR) go install honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
 
 # Run staticcheck
-staticcheck:
-	@staticcheck ./...
+staticcheck-run:
+	@if [ ! -d "$(STATICCHECK_VERSION_DIR)" ]; then \
+		make staticcheck-install; \
+	fi
+	@$(STATICCHECK_VERSION_DIR)/staticcheck ./...
 
 # Run linters in Docker
 docker/lint:
@@ -161,7 +219,6 @@ version:
 
 # Delete built artifacts
 clean:
-	rm -rf vendor
 	rm -rf .cache
 	rm -rf $(BIN)
 	rm -rf $(RELEASE)

README.md

@@ -49,7 +49,7 @@ The latest version of frostfs-node works with frostfs-contract
 
 # Building
 
-To make all binaries you need Go 1.18+ and `make`:
+To make all binaries you need Go 1.20+ and `make`:
 ```
 make all
 ```

cmd/frostfs-adm/README.md

@@ -36,9 +36,7 @@ alphabet-wallets: /path            # path to consensus node / alphabet wallets s
 network:
   max_object_size: 67108864 # max size of a single FrostFS object, bytes
   epoch_duration: 240       # duration of a FrostFS epoch in blocks, consider block generation frequency in the sidechain
-  basic_income_rate: 0      # basic income rate, for private consider 0
   fee:
-    audit: 0     # network audit fee, for private installation consider 0
     candidate: 0 # inner ring candidate registration fee, for private installation consider 0
     container: 0 # container creation fee, for private installation consider 0
     container_alias: 0 # container nice-name registration fee, for private installation consider 0

cmd/frostfs-adm/docs/deploy.md

@@ -18,6 +18,7 @@ To start a network, you need a set of consensus nodes, the same number of
 Alphabet nodes and any number of Storage nodes. While the number of Storage
 nodes can be scaled almost infinitely, the number of consensus and Alphabet
 nodes can't be changed so easily right now. Consider this before going any further.
+Note also that there is an upper limit on the number of alphabet nodes (currently 22).
 
 It is easier to use`frostfs-adm` with a predefined configuration. First, create
 a network configuration file. In this example, there is going to be only one
@@ -33,9 +34,7 @@ alphabet-wallets: /home/user/deploy/alphabet-wallets
 network:
   max_object_size: 67108864
   epoch_duration: 240
-  basic_income_rate: 0
   fee:
-    audit: 0
     candidate: 0
     container: 0
     withdraw: 0
@@ -141,13 +140,11 @@ Waiting for transactions to persist...
 Stage 7: set addresses in NNS.
 Waiting for transactions to persist...
 NNS: Set alphabet0.frostfs -> f692dfb4d43a15b464eb51a7041160fb29c44b6a
-NNS: Set audit.frostfs -> 7df847b993affb3852074345a7c2bd622171ee0d
 NNS: Set balance.frostfs -> 103519b3067a66307080a66570c0491ee8f68879
 NNS: Set container.frostfs -> cae60bdd689d185901e495352d0247752ce50846
 NNS: Set frostfsid.frostfs -> c421fb60a3895865a8f24d197d6a80ef686041d2
 NNS: Set netmap.frostfs -> 894eb854632f50fb124412ce7951ebc00763525e
 NNS: Set proxy.frostfs -> ac6e6fe4b373d0ca0ca4969d1e58fa0988724e7d
-NNS: Set reputation.frostfs -> 6eda57c9d93d990573646762d1fea327ce41191f
 Waiting for transactions to persist...
 ```
 

cmd/frostfs-adm/docs/subnetwork-creation.md

@@ -1,39 +0,0 @@
-# FrostFS subnetwork creation
-
-This is a short guide on how to create FrostFS subnetworks. This guide
-considers that the sidechain and the inner ring (alphabet nodes) have already been
-deployed and the sidechain contains a deployed `subnet` contract.
-
-## Prerequisites
-
-To follow this guide, you need:
-- neo-go sidechain RPC endpoint;
-- latest released version of [frostfs-adm](https://github.com/TrueCloudLab/frostfs-node/releases);
-- wallet with FrostFS account.
-
-## Creation
-
-```shell
-$ frostfs-adm morph subnet create \
-    -r <side_chain_RPC_endpoint> \
-    -w </path/to/owner/wallet> \
-    --notary
-Create subnet request sent successfully. ID: 4223489767.
-```
-
-**NOTE:** in notary-enabled environment you should have a sufficient
-notary deposit (not expired, with enough GAS balance). Your subnet ID
-will differ from the example.
-
-The default account in the wallet that has been passed with `-w` flag is the owner
-of the just created subnetwork.
-
-You can check if your subnetwork was created successfully:
-
-```shell
-$ frostfs-adm morph subnet get \
-    -r <side_chain_RPC_endpoint> \
-    --subnet <subnet_ID>
-Owner: NUc734PMJXiqa2J9jRtvskU3kCdyyuSN8Q
-```
-Your owner will differ from the example.

cmd/frostfs-adm/docs/subnetwork-usage.md

@@ -1,137 +0,0 @@
-# Managing Subnetworks
-
-This is a short guide on how to manage FrostFS subnetworks. This guide
-considers that the sidechain and the inner ring (alphabet nodes) have already been
-deployed, and the sidechain contains a deployed `subnet` contract.
-
-## Prerequisites
-
-- neo-go sidechain RPC endpoint;
-- latest released version of [frostfs-adm](https://github.com/TrueCloudLab/frostfs-node/releases);
-- [created](subnetwork-creation.md) subnetwork;
-- wallet with the account that owns the subnetwork;
-- public key of the Storage Node;
-- public keys of the node and client administrators;
-- owner IDs of the FrostFS users.
-
-## Add node administrator
-
-Node administrators are accounts that can manage (add and delete nodes)
-the whitelist of the nodes which can be included to a subnetwork. Only the subnet
-owner is allowed to add and remove node administrators from the subnetwork.
-
-```shell
-$ frostfs-adm morph subnet admin add \
-    -r <side_chain_RPC_endpoint> \
-    -w </path/to/owner/wallet> \
-    --admin <HEX_admin_public_key> \
-    --subnet <subnet_ID>
-Add admin request sent successfully.
-```
-
-## Add node
-
-Adding a node to a subnetwork means that the node becomes able to service
-containers that have been created in that subnetwork. Addition only changes
-the list of the allowed nodes. Node is not required to be bootstrapped at the
-moment of its inclusion.
-
-```shell
-$ frostfs-adm morph subnet node add \
-    -r <side_chain_RPC_endpoint> \
-    -w </path/to/node_admin/wallet> \
-    --node <HEX_node_public_key> \
-    --subnet <subnet_ID>
-Add node request sent successfully.
-```
-
-**NOTE:** the owner of the subnetwork is also allowed to add nodes.
-
-## Add client administrator
-
-Client administrators are accounts that can manage (add and delete
-nodes) the whitelist of the clients that can create containers in the
-subnetwork. Only the subnet owner is allowed to add and remove client
-administrators from the subnetwork.
-
-```shell
-$ frostfs-adm morph subnet admin add \
-    -r <side_chain_RPC_endpoint> \
-    -w </path/to/owner/wallet> \
-    --admin <HEX_admin_public_key> \
-    --subnet <subnet_ID> \
-    --client \
-    --group <group_ID>
-Add admin request sent successfully.
-```
-
-**NOTE:** you do not need to create a group explicitly, it will be created
-right after the first client admin is added. Group ID is a 4-byte
-positive integer number.
-
-## Add client
-
-```shell
-$ frostfs-adm morph subnet client add \
-    -r <side_chain_RPC_endpoint> \
-    -w </path/to/client_admin/wallet> \
-    --client <client_ownerID> \
-    --subnet <subnet_ID> \
-    --group <group_ID>
-Add client request sent successfully.
-```
-
-**NOTE:** the owner of the subnetwork is also allowed to add clients. This is
-the only one command that accepts `ownerID`, not the public key.
-Administrator can manage only their group (a group where that administrator
-has been added by the subnet owner).
-
-# Bootstrapping Storage Node
-
-After a subnetwork [is created](subnetwork-creation.md) and a node is included into it, the
-node could be bootstrapped and service subnetwork containers.
-
-For bootstrapping, you need to specify the ID of the subnetwork in the node's
-configuration:
-
-```yaml
-...
-node:
-  ...
-  subnet:
-    entries: # list of IDs of subnets to enter in a text format of FrostFS API protocol (overrides corresponding attributes)
-      - <subnetwork_ID>
-  ...
-...
-```
-
-**NOTE:** specifying subnetwork that is denied for the node is not an error:
-that configuration value would be ignored. You do not need to specify zero
-(with 0 ID) subnetwork: its inclusion is implicit. On the contrary, to exclude
-a node from the default zero subnetwork, you need to specify it explicitly:
-
-```yaml
-...
-node:
-  ...
-  subnet:
-    exit_zero: true # toggle entrance to zero subnet (overrides corresponding attribute and occurrence in `entries`)
-  ...
-...
-```
-
-# Creating container in non-zero subnetwork
-
-Creating containers without using `--subnet` flag is equivalent to
-creating container in the zero subnetwork.
-
-To create a container in a private network, your wallet must be added to
-the client whitelist by the client admins or the subnet owners:
-
-```shell
-$ frostfs-cli container create \
-    --policy 'REP 1' \
-    -w </path/to/wallet> \
-    -r s01.frostfs.devenv:8080 \
-    --subnet <subnet_ID>
-```

cmd/frostfs-adm/internal/modules/config/config.go

@@ -18,8 +18,6 @@ type configTemplate struct {
 	AlphabetDir             string
 	MaxObjectSize           int
 	EpochDuration           int
-	BasicIncomeRate         int
-	AuditFee                int
 	CandidateFee            int
 	ContainerFee            int
 	ContainerAliasFee       int
@@ -33,10 +31,8 @@ alphabet-wallets: {{ .AlphabetDir}}
 network:
   max_object_size: {{ .MaxObjectSize}}
   epoch_duration: {{ .EpochDuration}}
-  basic_income_rate: {{ .BasicIncomeRate}}
   homomorphic_hash_disabled: {{ .HomomorphicHashDisabled}}
   fee:
-    audit: {{ .AuditFee}}
     candidate: {{ .CandidateFee}}
     container: {{ .ContainerFee}}
     container_alias: {{ .ContainerAliasFee }}
@@ -47,19 +43,19 @@ credentials:
   {{.}}: password{{end}}
 `
 
-func initConfig(cmd *cobra.Command, args []string) error {
+func initConfig(cmd *cobra.Command, _ []string) error {
 	configPath, err := readConfigPathFromArgs(cmd)
 	if err != nil {
 		return nil
 	}
 
 	pathDir := filepath.Dir(configPath)
-	err = os.MkdirAll(pathDir, 0700)
+	err = os.MkdirAll(pathDir, 0o700)
 	if err != nil {
 		return fmt.Errorf("create dir %s: %w", pathDir, err)
 	}
 
-	f, err := os.OpenFile(configPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC|os.O_SYNC, 0600)
+	f, err := os.OpenFile(configPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC|os.O_SYNC, 0o600)
 	if err != nil {
 		return fmt.Errorf("open %s: %w", configPath, err)
 	}
@@ -111,9 +107,7 @@ func generateConfigExample(appDir string, credSize int) (string, error) {
 		Endpoint:                "https://neo.rpc.node:30333",
 		MaxObjectSize:           67108864,      // 64 MiB
 		EpochDuration:           240,           // 1 hour with 15s per block
-		BasicIncomeRate:         1_0000_0000,   // 0.0001 GAS per GiB (Fixed12)
 		HomomorphicHashDisabled: false,         // object homomorphic hash is enabled
-		AuditFee:                1_0000,        // 0.00000001 GAS per audit (Fixed12)
 		CandidateFee:            100_0000_0000, // 100.0 GAS (Fixed8)
 		ContainerFee:            1000,          // 0.000000001 * 7 GAS per container (Fixed12)
 		ContainerAliasFee:       500,           // ContainerFee / 2

cmd/frostfs-adm/internal/modules/config/config_test.go

@@ -28,8 +28,6 @@ func TestGenerateConfigExample(t *testing.T) {
 	require.Equal(t, filepath.Join(appDir, "alphabet-wallets"), v.GetString("alphabet-wallets"))
 	require.Equal(t, 67108864, v.GetInt("network.max_object_size"))
 	require.Equal(t, 240, v.GetInt("network.epoch_duration"))
-	require.Equal(t, 100000000, v.GetInt("network.basic_income_rate"))
-	require.Equal(t, 10000, v.GetInt("network.fee.audit"))
 	require.Equal(t, 10000000000, v.GetInt("network.fee.candidate"))
 	require.Equal(t, 1000, v.GetInt("network.fee.container"))
 	require.Equal(t, 100000000, v.GetInt("network.fee.withdraw"))

cmd/frostfs-adm/internal/modules/morph/balance.go

@@ -16,6 +16,7 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/io"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/gas"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/rolemgmt"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
@@ -37,11 +38,6 @@ const (
 	dumpBalancesAlphabetFlag      = "alphabet"
 	dumpBalancesProxyFlag         = "proxy"
 	dumpBalancesUseScriptHashFlag = "script-hash"
-
-	// notaryEnabled signifies whether contracts were deployed in a notary-enabled environment.
-	// The setting is here to simplify testing and building the command for testnet (notary currently disabled).
-	// It will be removed eventually.
-	notaryEnabled = true
 )
 
 func dumpBalances(cmd *cobra.Command, _ []string) error {
@@ -60,8 +56,9 @@ func dumpBalances(cmd *cobra.Command, _ []string) error {
 
 	inv := invoker.New(c, nil)
 
-	if !notaryEnabled || dumpStorage || dumpAlphabet || dumpProxy {
-		nnsCs, err = c.GetContractStateByID(1)
+	if dumpStorage || dumpAlphabet || dumpProxy {
+		r := management.NewReader(inv)
+		nnsCs, err = r.GetContractByID(1)
 		if err != nil {
 			return fmt.Errorf("can't get NNS contract info: %w", err)
 		}
@@ -72,7 +69,7 @@ func dumpBalances(cmd *cobra.Command, _ []string) error {
 		}
 	}
 
-	irList, err := fetchIRNodes(c, nmHash, rolemgmt.Hash)
+	irList, err := fetchIRNodes(c, rolemgmt.Hash)
 	if err != nil {
 		return err
 	}
@@ -187,40 +184,22 @@ func printAlphabetContractBalances(cmd *cobra.Command, c Client, inv *invoker.In
 	return nil
 }
 
-func fetchIRNodes(c Client, nmHash, desigHash util.Uint160) ([]accBalancePair, error) {
-	var irList []accBalancePair
-
+func fetchIRNodes(c Client, desigHash util.Uint160) ([]accBalancePair, error) {
 	inv := invoker.New(c, nil)
 
-	if notaryEnabled {
-		height, err := c.GetBlockCount()
-		if err != nil {
-			return nil, fmt.Errorf("can't get block height: %w", err)
-		}
+	height, err := c.GetBlockCount()
+	if err != nil {
+		return nil, fmt.Errorf("can't get block height: %w", err)
+	}
 
-		arr, err := getDesignatedByRole(inv, desigHash, noderoles.NeoFSAlphabet, height)
-		if err != nil {
-			return nil, errors.New("can't fetch list of IR nodes from the netmap contract")
-		}
+	arr, err := getDesignatedByRole(inv, desigHash, noderoles.NeoFSAlphabet, height)
+	if err != nil {
+		return nil, errors.New("can't fetch list of IR nodes from the netmap contract")
+	}
 
-		irList = make([]accBalancePair, len(arr))
-		for i := range arr {
-			irList[i].scriptHash = arr[i].GetScriptHash()
-		}
-	} else {
-		arr, err := unwrap.ArrayOfBytes(inv.Call(nmHash, "innerRingList"))
-		if err != nil {
-			return nil, errors.New("can't fetch list of IR nodes from the netmap contract")
-		}
-
-		irList = make([]accBalancePair, len(arr))
-		for i := range arr {
-			pub, err := keys.NewPublicKeyFromBytes(arr[i], elliptic.P256())
-			if err != nil {
-				return nil, fmt.Errorf("can't parse IR node public key: %w", err)
-			}
-			irList[i].scriptHash = pub.GetScriptHash()
-		}
+	irList := make([]accBalancePair, len(arr))
+	for i := range arr {
+		irList[i].scriptHash = arr[i].GetScriptHash()
 	}
 	return irList, nil
 }

cmd/frostfs-adm/internal/modules/morph/config.go

@@ -10,12 +10,13 @@ import (
 	"strings"
 	"text/tabwriter"
 
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/client/netmap"
 	"github.com/nspcc-dev/neo-go/pkg/io"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/vm/emit"
-	"github.com/nspcc-dev/neo-go/pkg/vm/stackitem"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -29,8 +30,9 @@ func dumpNetworkConfig(cmd *cobra.Command, _ []string) error {
 	}
 
 	inv := invoker.New(c, nil)
+	r := management.NewReader(inv)
 
-	cs, err := c.GetContractStateByID(1)
+	cs, err := r.GetContractByID(1)
 	if err != nil {
 		return fmt.Errorf("can't get NNS contract info: %w", err)
 	}
@@ -48,41 +50,24 @@ func dumpNetworkConfig(cmd *cobra.Command, _ []string) error {
 	buf := bytes.NewBuffer(nil)
 	tw := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
 
-	for _, param := range arr {
-		tuple, ok := param.Value().([]stackitem.Item)
-		if !ok || len(tuple) != 2 {
-			return errors.New("invalid ListConfig response from netmap contract")
-		}
-
-		k, err := tuple[0].TryBytes()
-		if err != nil {
-			return errors.New("invalid config key from netmap contract")
-		}
-
-		v, err := tuple[1].TryBytes()
-		if err != nil {
-			return invalidConfigValueErr(k)
-		}
-
-		switch string(k) {
-		case netmapAuditFeeKey, netmapBasicIncomeRateKey,
-			netmapContainerFeeKey, netmapContainerAliasFeeKey,
-			netmapEigenTrustIterationsKey,
-			netmapEpochKey, netmapInnerRingCandidateFeeKey,
-			netmapMaxObjectSizeKey, netmapWithdrawFeeKey:
+	m, err := parseConfigFromNetmapContract(arr)
+	if err != nil {
+		return err
+	}
+	for k, v := range m {
+		switch k {
+		case netmap.ContainerFeeConfig, netmap.ContainerAliasFeeConfig,
+			netmap.EpochDurationConfig, netmap.IrCandidateFeeConfig,
+			netmap.MaxObjectSizeConfig, netmap.WithdrawFeeConfig:
 			nbuf := make([]byte, 8)
 			copy(nbuf[:], v)
 			n := binary.LittleEndian.Uint64(nbuf)
 			_, _ = tw.Write([]byte(fmt.Sprintf("%s:\t%d (int)\n", k, n)))
-		case netmapEigenTrustAlphaKey:
-			_, _ = tw.Write([]byte(fmt.Sprintf("%s:\t%s (str)\n", k, v)))
-		case netmapHomomorphicHashDisabledKey, netmapMaintenanceAllowedKey:
-			vBool, err := tuple[1].TryBool()
-			if err != nil {
+		case netmap.HomomorphicHashingDisabledKey, netmap.MaintenanceModeAllowedConfig:
+			if len(v) == 0 || len(v) > 1 {
 				return invalidConfigValueErr(k)
 			}
-
-			_, _ = tw.Write([]byte(fmt.Sprintf("%s:\t%t (bool)\n", k, vBool)))
+			_, _ = tw.Write([]byte(fmt.Sprintf("%s:\t%t (bool)\n", k, v[0] == 1)))
 		default:
 			_, _ = tw.Write([]byte(fmt.Sprintf("%s:\t%s (hex)\n", k, hex.EncodeToString(v))))
 		}
@@ -104,7 +89,8 @@ func setConfigCmd(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("can't initialize context: %w", err)
 	}
 
-	cs, err := wCtx.Client.GetContractStateByID(1)
+	r := management.NewReader(wCtx.ReadOnlyInvoker)
+	cs, err := r.GetContractByID(1)
 	if err != nil {
 		return fmt.Errorf("can't get NNS contract info: %w", err)
 	}
@@ -150,25 +136,14 @@ func parseConfigPair(kvStr string, force bool) (key string, val any, err error)
 	valRaw := v
 
 	switch key {
-	case netmapAuditFeeKey, netmapBasicIncomeRateKey,
-		netmapContainerFeeKey, netmapContainerAliasFeeKey,
-		netmapEigenTrustIterationsKey,
-		netmapEpochKey, netmapInnerRingCandidateFeeKey,
-		netmapMaxObjectSizeKey, netmapWithdrawFeeKey:
+	case netmap.ContainerFeeConfig, netmap.ContainerAliasFeeConfig,
+		netmap.EpochDurationConfig, netmap.IrCandidateFeeConfig,
+		netmap.MaxObjectSizeConfig, netmap.WithdrawFeeConfig:
 		val, err = strconv.ParseInt(valRaw, 10, 64)
 		if err != nil {
 			err = fmt.Errorf("could not parse %s's value '%s' as int: %w", key, valRaw, err)
 		}
-	case netmapEigenTrustAlphaKey:
-		// just check that it could
-		// be parsed correctly
-		_, err = strconv.ParseFloat(v, 64)
-		if err != nil {
-			err = fmt.Errorf("could not parse %s's value '%s' as float: %w", key, valRaw, err)
-		}
-
-		val = valRaw
-	case netmapHomomorphicHashDisabledKey, netmapMaintenanceAllowedKey:
+	case netmap.HomomorphicHashingDisabledKey, netmap.MaintenanceModeAllowedConfig:
 		val, err = strconv.ParseBool(valRaw)
 		if err != nil {
 			err = fmt.Errorf("could not parse %s's value '%s' as bool: %w", key, valRaw, err)
@@ -187,6 +162,6 @@ func parseConfigPair(kvStr string, force bool) (key string, val any, err error)
 	return
 }
 
-func invalidConfigValueErr(key []byte) error {
+func invalidConfigValueErr(key string) error {
 	return fmt.Errorf("invalid %s config value from netmap contract", key)
 }

cmd/frostfs-adm/internal/modules/morph/container.go

@@ -11,6 +11,7 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/crypto/hash"
 	"github.com/nspcc-dev/neo-go/pkg/io"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/util"
@@ -22,14 +23,15 @@ import (
 
 var errInvalidContainerResponse = errors.New("invalid response from container contract")
 
-func getContainerContractHash(cmd *cobra.Command, inv *invoker.Invoker, c Client) (util.Uint160, error) {
+func getContainerContractHash(cmd *cobra.Command, inv *invoker.Invoker) (util.Uint160, error) {
 	s, err := cmd.Flags().GetString(containerContractFlag)
 	var ch util.Uint160
 	if err == nil {
 		ch, err = util.Uint160DecodeStringLE(s)
 	}
 	if err != nil {
-		nnsCs, err := c.GetContractStateByID(1)
+		r := management.NewReader(inv)
+		nnsCs, err := r.GetContractByID(1)
 		if err != nil {
 			return util.Uint160{}, fmt.Errorf("can't get NNS contract state: %w", err)
 		}
@@ -78,7 +80,7 @@ func dumpContainers(cmd *cobra.Command, _ []string) error {
 
 	inv := invoker.New(c, nil)
 
-	ch, err := getContainerContractHash(cmd, inv, c)
+	ch, err := getContainerContractHash(cmd, inv)
 	if err != nil {
 		return fmt.Errorf("unable to get contaract hash: %w", err)
 	}
@@ -168,7 +170,7 @@ func listContainers(cmd *cobra.Command, _ []string) error {
 
 	inv := invoker.New(c, nil)
 
-	ch, err := getContainerContractHash(cmd, inv, c)
+	ch, err := getContainerContractHash(cmd, inv)
 	if err != nil {
 		return fmt.Errorf("unable to get contaract hash: %w", err)
 	}
@@ -298,7 +300,8 @@ func parseContainers(filename string) ([]Container, error) {
 }
 
 func fetchContainerContractHash(wCtx *initializeContext) (util.Uint160, error) {
-	nnsCs, err := wCtx.Client.GetContractStateByID(1)
+	r := management.NewReader(wCtx.ReadOnlyInvoker)
+	nnsCs, err := r.GetContractByID(1)
 	if err != nil {
 		return util.Uint160{}, fmt.Errorf("can't get NNS contract state: %w", err)
 	}

cmd/frostfs-adm/internal/modules/morph/deploy.go

@@ -76,7 +76,8 @@ func deployContractCmd(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	nnsCs, err := c.Client.GetContractStateByID(1)
+	r := management.NewReader(c.ReadOnlyInvoker)
+	nnsCs, err := r.GetContractByID(1)
 	if err != nil {
 		return fmt.Errorf("can't fetch NNS contract state: %w", err)
 	}
@@ -145,12 +146,12 @@ func registerNNS(nnsCs *state.Contract, c *initializeContext, zone string, domai
 
 		emit.AppCall(bw.BinWriter, nnsCs.Hash, "register", callflag.All,
 			zone, c.CommitteeAcc.Contract.ScriptHash(),
-			"ops@nspcc.ru", int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
+			frostfsOpsEmail, int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
 		emit.Opcodes(bw.BinWriter, opcode.ASSERT)
 
 		emit.AppCall(bw.BinWriter, nnsCs.Hash, "register", callflag.All,
 			domain, c.CommitteeAcc.Contract.ScriptHash(),
-			"ops@nspcc.ru", int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
+			frostfsOpsEmail, int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
 		emit.Opcodes(bw.BinWriter, opcode.ASSERT)
 	} else {
 		s, ok, err := c.nnsRegisterDomainScript(nnsCs.Hash, cs.Hash, domain)

cmd/frostfs-adm/internal/modules/morph/download.go

@@ -1,40 +0,0 @@
-package morph
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-
-	"github.com/google/go-github/v39/github"
-	"github.com/spf13/cobra"
-)
-
-func downloadContractsFromGithub(cmd *cobra.Command) (io.ReadCloser, error) {
-	gcl := github.NewClient(nil)
-	release, _, err := gcl.Repositories.GetLatestRelease(context.Background(), "nspcc-dev", "frostfs-contract")
-	if err != nil {
-		return nil, fmt.Errorf("can't fetch release info: %w", err)
-	}
-
-	cmd.Printf("Found %s (%s), downloading...\n", release.GetTagName(), release.GetName())
-
-	var url string
-	for _, a := range release.Assets {
-		if strings.HasPrefix(a.GetName(), "frostfs-contract") {
-			url = a.GetBrowserDownloadURL()
-			break
-		}
-	}
-	if url == "" {
-		return nil, errors.New("can't find contracts archive in release assets")
-	}
-
-	resp, err := http.Get(url)
-	if err != nil {
-		return nil, fmt.Errorf("can't fetch contracts archive: %w", err)
-	}
-	return resp.Body, nil
-}

cmd/frostfs-adm/internal/modules/morph/dump_hashes.go

@@ -11,6 +11,7 @@ import (
 	morphClient "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/client"
 	"github.com/nspcc-dev/neo-go/pkg/io"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/util"
@@ -36,7 +37,8 @@ func dumpContractHashes(cmd *cobra.Command, _ []string) error {
 		return fmt.Errorf("can't create N3 client: %w", err)
 	}
 
-	cs, err := c.GetContractStateByID(1)
+	r := management.NewReader(invoker.New(c, nil))
+	cs, err := r.GetContractByID(1)
 	if err != nil {
 		return err
 	}

cmd/frostfs-adm/internal/modules/morph/epoch.go

@@ -3,8 +3,10 @@ package morph
 import (
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/nspcc-dev/neo-go/pkg/io"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/util"
@@ -13,13 +15,14 @@ import (
 	"github.com/spf13/viper"
 )
 
-func forceNewEpochCmd(cmd *cobra.Command, args []string) error {
+func forceNewEpochCmd(cmd *cobra.Command, _ []string) error {
 	wCtx, err := newInitializeContext(cmd, viper.GetViper())
 	if err != nil {
 		return fmt.Errorf("can't to initialize context: %w", err)
 	}
 
-	cs, err := wCtx.Client.GetContractStateByID(1)
+	r := management.NewReader(wCtx.ReadOnlyInvoker)
+	cs, err := r.GetContractByID(1)
 	if err != nil {
 		return fmt.Errorf("can't get NNS contract info: %w", err)
 	}
@@ -38,7 +41,14 @@ func forceNewEpochCmd(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	return wCtx.awaitTx()
+	if err := wCtx.awaitTx(); err != nil {
+		if strings.Contains(err.Error(), "invalid epoch") {
+			cmd.Println("Epoch has already ticked.")
+			return nil
+		}
+		return err
+	}
+	return nil
 }
 
 func emitNewEpochCall(bw *io.BufBinWriter, wCtx *initializeContext, nmHash util.Uint160) error {

cmd/frostfs-adm/internal/modules/morph/frostfsid_util.go

@@ -0,0 +1,42 @@
+package morph
+
+import (
+	"fmt"
+
+	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
+	"github.com/nspcc-dev/neo-go/pkg/encoding/address"
+	"github.com/nspcc-dev/neo-go/pkg/smartcontract"
+	"github.com/nspcc-dev/neo-go/pkg/util"
+	"github.com/spf13/viper"
+)
+
+// neo-go doesn't support []util.Uint160 type:
+// https://github.com/nspcc-dev/neo-go/blob/v0.103.0/pkg/smartcontract/parameter.go#L262
+// Thus, return []smartcontract.Parameter.
+func getFrostfsIDAuthorizedKeys(v *viper.Viper, defaultOwner util.Uint160) ([]smartcontract.Parameter, error) {
+	var res []smartcontract.Parameter
+	res = append(res, smartcontract.Parameter{Type: smartcontract.Hash160Type, Value: defaultOwner})
+
+	ks := v.GetStringSlice(frostfsIDAuthorizedKeysConfigKey)
+	for i := range ks {
+		h, err := address.StringToUint160(ks[i])
+		if err == nil {
+			res = append(res, smartcontract.Parameter{Type: smartcontract.Hash160Type, Value: h})
+			continue
+		}
+
+		h, err = util.Uint160DecodeStringLE(ks[i])
+		if err == nil {
+			res = append(res, smartcontract.Parameter{Type: smartcontract.Hash160Type, Value: h})
+			continue
+		}
+
+		pk, err := keys.NewPublicKeyFromString(ks[i])
+		if err == nil {
+			res = append(res, smartcontract.Parameter{Type: smartcontract.Hash160Type, Value: pk.GetScriptHash()})
+			continue
+		}
+		return nil, fmt.Errorf("frostfsid: #%d item in authorized_keys is invalid: '%s'", i, ks[i])
+	}
+	return res, nil
+}

cmd/frostfs-adm/internal/modules/morph/frostfsid_util_test.go

@@ -0,0 +1,49 @@
+package morph
+
+import (
+	"encoding/hex"
+	"testing"
+
+	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
+	"github.com/nspcc-dev/neo-go/pkg/encoding/address"
+	"github.com/nspcc-dev/neo-go/pkg/smartcontract"
+	"github.com/nspcc-dev/neo-go/pkg/util"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFrostfsIDConfig(t *testing.T) {
+	pks := make([]*keys.PrivateKey, 4)
+	for i := range pks {
+		pk, err := keys.NewPrivateKey()
+		require.NoError(t, err)
+		pks[i] = pk
+	}
+
+	v := viper.New()
+	v.Set("frostfsid.authorized_keys", []string{
+		pks[0].GetScriptHash().StringLE(),
+		address.Uint160ToString(pks[1].GetScriptHash()),
+		hex.EncodeToString(pks[2].PublicKey().UncompressedBytes()),
+		hex.EncodeToString(pks[3].PublicKey().Bytes()),
+	})
+
+	comm := util.Uint160{1, 2, 3}
+	actual, err := getFrostfsIDAuthorizedKeys(v, comm)
+	require.NoError(t, err)
+	require.Equal(t, len(pks)+1, len(actual))
+	require.Equal(t, smartcontract.Hash160Type, actual[0].Type)
+	require.Equal(t, comm, actual[0].Value)
+	for i := range pks {
+		require.Equal(t, smartcontract.Hash160Type, actual[i+1].Type)
+		require.Equal(t, pks[i].GetScriptHash(), actual[i+1].Value)
+	}
+
+	t.Run("bad key", func(t *testing.T) {
+		v := viper.New()
+		v.Set("frostfsid.authorized_keys", []string{"abc"})
+
+		_, err := getFrostfsIDAuthorizedKeys(v, comm)
+		require.Error(t, err)
+	})
+}

cmd/frostfs-adm/internal/modules/morph/generate.go

@@ -21,6 +21,7 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/wallet"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"golang.org/x/sync/errgroup"
 )
 
 const (
@@ -29,7 +30,7 @@ const (
 	consensusAccountName = "consensus"
 )
 
-func generateAlphabetCreds(cmd *cobra.Command, args []string) error {
+func generateAlphabetCreds(cmd *cobra.Command, _ []string) error {
 	// alphabet size is not part of the config
 	size, err := cmd.Flags().GetUint(alphabetSizeFlag)
 	if err != nil {
@@ -38,6 +39,9 @@ func generateAlphabetCreds(cmd *cobra.Command, args []string) error {
 	if size == 0 {
 		return errors.New("size must be > 0")
 	}
+	if size > maxAlphabetNodes {
+		return ErrTooManyAlphabetNodes
+	}
 
 	v := viper.GetViper()
 	walletDir := config.ResolveHomePath(viper.GetString(alphabetWalletsFlag))
@@ -72,7 +76,7 @@ func initializeWallets(v *viper.Viper, walletDir string, size int) ([]string, er
 		}
 
 		p := filepath.Join(walletDir, innerring.GlagoliticLetter(i).String()+".json")
-		f, err := os.OpenFile(p, os.O_CREATE, 0644)
+		f, err := os.OpenFile(p, os.O_CREATE, 0o644)
 		if err != nil {
 			return nil, fmt.Errorf("can't create wallet file: %w", err)
 		}
@@ -92,28 +96,31 @@ func initializeWallets(v *viper.Viper, walletDir string, size int) ([]string, er
 		pubs[i] = w.Accounts[0].PrivateKey().PublicKey()
 	}
 
+	var errG errgroup.Group
+
 	// Create committee account with N/2+1 multi-signature.
 	majCount := smartcontract.GetMajorityHonestNodeCount(size)
-	for i, w := range wallets {
-		if err := addMultisigAccount(w, majCount, committeeAccountName, passwords[i], pubs); err != nil {
-			return nil, fmt.Errorf("can't create committee account: %w", err)
-		}
-	}
-
 	// Create consensus account with 2*N/3+1 multi-signature.
 	bftCount := smartcontract.GetDefaultHonestNodeCount(size)
-	for i, w := range wallets {
-		if err := addMultisigAccount(w, bftCount, consensusAccountName, passwords[i], pubs); err != nil {
-			return nil, fmt.Errorf("can't create consensus account: %w", err)
-		}
+	for i := range wallets {
+		i := i
+		ps := pubs.Copy()
+		errG.Go(func() error {
+			if err := addMultisigAccount(wallets[i], majCount, committeeAccountName, passwords[i], ps); err != nil {
+				return fmt.Errorf("can't create committee account: %w", err)
+			}
+			if err := addMultisigAccount(wallets[i], bftCount, consensusAccountName, passwords[i], ps); err != nil {
+				return fmt.Errorf("can't create consentus account: %w", err)
+			}
+			if err := wallets[i].SavePretty(); err != nil {
+				return fmt.Errorf("can't save wallet: %w", err)
+			}
+			return nil
+		})
 	}
-
-	for _, w := range wallets {
-		if err := w.SavePretty(); err != nil {
-			return nil, fmt.Errorf("can't save wallet: %w", err)
-		}
+	if err := errG.Wait(); err != nil {
+		return nil, err
 	}
-
 	return passwords, nil
 }
 

cmd/frostfs-adm/internal/modules/morph/generate_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"sync"
 	"testing"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/innerring"
@@ -71,24 +72,32 @@ func TestGenerateAlphabet(t *testing.T) {
 	buf.WriteString(testContractPassword + "\r")
 	require.NoError(t, generateAlphabetCreds(generateAlphabetCmd, nil))
 
+	var wg sync.WaitGroup
 	for i := uint64(0); i < size; i++ {
-		p := filepath.Join(walletDir, innerring.GlagoliticLetter(i).String()+".json")
-		w, err := wallet.NewWalletFromFile(p)
-		require.NoError(t, err, "wallet doesn't exist")
-		require.Equal(t, 3, len(w.Accounts), "not all accounts were created")
-		for _, a := range w.Accounts {
-			err := a.Decrypt(strconv.FormatUint(i, 10), keys.NEP2ScryptParams())
-			require.NoError(t, err, "can't decrypt account")
-			switch a.Label {
-			case consensusAccountName:
-				require.Equal(t, smartcontract.GetDefaultHonestNodeCount(size), len(a.Contract.Parameters))
-			case committeeAccountName:
-				require.Equal(t, smartcontract.GetMajorityHonestNodeCount(size), len(a.Contract.Parameters))
-			default:
-				require.Equal(t, singleAccountName, a.Label)
+		i := i
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			p := filepath.Join(walletDir, innerring.GlagoliticLetter(i).String()+".json")
+			w, err := wallet.NewWalletFromFile(p)
+			require.NoError(t, err, "wallet doesn't exist")
+			require.Equal(t, 3, len(w.Accounts), "not all accounts were created")
+
+			for _, a := range w.Accounts {
+				err := a.Decrypt(strconv.FormatUint(i, 10), keys.NEP2ScryptParams())
+				require.NoError(t, err, "can't decrypt account")
+				switch a.Label {
+				case consensusAccountName:
+					require.Equal(t, smartcontract.GetDefaultHonestNodeCount(size), len(a.Contract.Parameters))
+				case committeeAccountName:
+					require.Equal(t, smartcontract.GetMajorityHonestNodeCount(size), len(a.Contract.Parameters))
+				default:
+					require.Equal(t, singleAccountName, a.Label)
+				}
 			}
-		}
+		}()
 	}
+	wg.Wait()
 
 	t.Run("check contract group wallet", func(t *testing.T) {
 		p := filepath.Join(walletDir, contractWalletFilename)

cmd/frostfs-adm/internal/modules/morph/initialize.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-adm/internal/commonflags"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-adm/internal/modules/config"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/innerring"
 	morphClient "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/client"
@@ -15,6 +16,7 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/core/transaction"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/trigger"
 	"github.com/nspcc-dev/neo-go/pkg/util"
 	"github.com/nspcc-dev/neo-go/pkg/vm/vmstate"
@@ -23,6 +25,13 @@ import (
 	"github.com/spf13/viper"
 )
 
+const (
+	// maxAlphabetNodes is the maximum number of candidates allowed, which is currently limited by the size
+	// of the invocation script.
+	// See: https://github.com/nspcc-dev/neo-go/blob/740488f7f35e367eaa99a71c0a609c315fe2b0fc/pkg/core/transaction/witness.go#L10
+	maxAlphabetNodes = 22
+)
+
 type cache struct {
 	nnsCs    *state.Contract
 	groupKey *keys.PublicKey
@@ -45,7 +54,9 @@ type initializeContext struct {
 	ContractPath string
 }
 
-func initializeSideChainCmd(cmd *cobra.Command, args []string) error {
+var ErrTooManyAlphabetNodes = fmt.Errorf("too many alphabet nodes (maximum allowed is %d)", maxAlphabetNodes)
+
+func initializeSideChainCmd(cmd *cobra.Command, _ []string) error {
 	initCtx, err := newInitializeContext(cmd, viper.GetViper())
 	if err != nil {
 		return fmt.Errorf("initialization error: %w", err)
@@ -91,11 +102,7 @@ func initializeSideChainCmd(cmd *cobra.Command, args []string) error {
 	}
 
 	cmd.Println("Stage 7: set addresses in NNS.")
-	if err := initCtx.setNNS(); err != nil {
-		return err
-	}
-
-	return nil
+	return initCtx.setNNS()
 }
 
 func (c *initializeContext) close() {
@@ -115,6 +122,10 @@ func newInitializeContext(cmd *cobra.Command, v *viper.Viper) (*initializeContex
 		return nil, err
 	}
 
+	if len(wallets) > maxAlphabetNodes {
+		return nil, ErrTooManyAlphabetNodes
+	}
+
 	needContracts := cmd.Name() == "update-contracts" || cmd.Name() == "init"
 
 	var w *wallet.Wallet
@@ -142,7 +153,7 @@ func newInitializeContext(cmd *cobra.Command, v *viper.Viper) (*initializeContex
 		return nil, err
 	}
 
-	ctrPath, err := getContractsPath(cmd, v, needContracts)
+	ctrPath, err := getContractsPath(cmd, needContracts)
 	if err != nil {
 		return nil, err
 	}
@@ -201,11 +212,11 @@ func validateInit(cmd *cobra.Command) error {
 func createClient(cmd *cobra.Command, v *viper.Viper, wallets []*wallet.Wallet) (Client, error) {
 	var c Client
 	var err error
-	if v.GetString(localDumpFlag) != "" {
-		if v.GetString(endpointFlag) != "" {
+	if ldf := cmd.Flags().Lookup(localDumpFlag); ldf != nil && ldf.Changed {
+		if cmd.Flags().Changed(endpointFlag) {
 			return nil, fmt.Errorf("`%s` and `%s` flags are mutually exclusive", endpointFlag, localDumpFlag)
 		}
-		c, err = newLocalClient(cmd, v, wallets)
+		c, err = newLocalClient(cmd, v, wallets, ldf.Value.String())
 	} else {
 		c, err = getN3Client(v)
 	}
@@ -222,7 +233,7 @@ func getWallet(cmd *cobra.Command, v *viper.Viper, needContracts bool, walletDir
 	return openContractWallet(v, cmd, walletDir)
 }
 
-func getContractsPath(cmd *cobra.Command, v *viper.Viper, needContracts bool) (string, error) {
+func getContractsPath(cmd *cobra.Command, needContracts bool) (string, error) {
 	if !needContracts {
 		return "", nil
 	}
@@ -303,7 +314,8 @@ func (c *initializeContext) nnsContractState() (*state.Contract, error) {
 		return c.nnsCs, nil
 	}
 
-	cs, err := c.Client.GetContractStateByID(1)
+	r := management.NewReader(c.ReadOnlyInvoker)
+	cs, err := r.GetContractByID(1)
 	if err != nil {
 		return nil, err
 	}
@@ -365,36 +377,18 @@ func (c *clientContext) awaitTx(cmd *cobra.Command) error {
 func awaitTx(cmd *cobra.Command, c Client, txs []hashVUBPair) error {
 	cmd.Println("Waiting for transactions to persist...")
 
-	const pollInterval = time.Second
-
-	tick := time.NewTicker(pollInterval)
-	defer tick.Stop()
-
 	at := trigger.Application
 
 	var retErr error
 
-	currBlock, err := c.GetBlockCount()
-	if err != nil {
-		return fmt.Errorf("can't fetch current block height: %w", err)
-	}
-
 loop:
 	for i := range txs {
-		res, err := c.GetApplicationLog(txs[i].hash, &at)
-		if err == nil {
-			if retErr == nil && len(res.Executions) > 0 && res.Executions[0].VMState != vmstate.Halt {
-				retErr = fmt.Errorf("tx %d persisted in %s state: %s",
-					i, res.Executions[0].VMState, res.Executions[0].FaultException)
-			}
-			continue loop
-		}
-		if txs[i].vub < currBlock {
-			return fmt.Errorf("tx was not persisted: vub=%d, height=%d", txs[i].vub, currBlock)
-		}
-		for range tick.C {
+		var it int
+		var pollInterval time.Duration
+		var pollIntervalChanged bool
+		for {
 			// We must fetch current height before application log, to avoid race condition.
-			currBlock, err = c.GetBlockCount()
+			currBlock, err := c.GetBlockCount()
 			if err != nil {
 				return fmt.Errorf("can't fetch current block height: %w", err)
 			}
@@ -409,12 +403,43 @@ loop:
 			if txs[i].vub < currBlock {
 				return fmt.Errorf("tx was not persisted: vub=%d, height=%d", txs[i].vub, currBlock)
 			}
+
+			pollInterval, pollIntervalChanged = nextPollInterval(it, pollInterval)
+			if pollIntervalChanged && viper.GetBool(commonflags.Verbose) {
+				cmd.Printf("Pool interval to check transaction persistence changed: %s\n", pollInterval.String())
+			}
+
+			timer := time.NewTimer(pollInterval)
+			select {
+			case <-cmd.Context().Done():
+				return cmd.Context().Err()
+			case <-timer.C:
+			}
+
+			it++
 		}
 	}
 
 	return retErr
 }
 
+func nextPollInterval(it int, previous time.Duration) (time.Duration, bool) {
+	const minPollInterval = 1 * time.Second
+	const maxPollInterval = 16 * time.Second
+	const changeAfter = 5
+	if it == 0 {
+		return minPollInterval, true
+	}
+	if it%changeAfter != 0 {
+		return previous, false
+	}
+	nextInterval := previous * 2
+	if nextInterval > maxPollInterval {
+		return maxPollInterval, previous != maxPollInterval
+	}
+	return nextInterval, true
+}
+
 // sendCommitteeTx creates transaction from script, signs it by committee nodes and sends it to RPC.
 // If tryGroup is false, global scope is used for the signer (useful when
 // working with native contracts).

cmd/frostfs-adm/internal/modules/morph/initialize_deploy.go

@@ -16,13 +16,13 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-contract/nns"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/innerring"
 	morphClient "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/client/netmap"
 	"github.com/nspcc-dev/neo-go/pkg/core/state"
-	"github.com/nspcc-dev/neo-go/pkg/core/transaction"
 	"github.com/nspcc-dev/neo-go/pkg/encoding/address"
 	io2 "github.com/nspcc-dev/neo-go/pkg/io"
-	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/manifest"
@@ -30,7 +30,7 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/util"
 	"github.com/nspcc-dev/neo-go/pkg/vm/emit"
 	"github.com/nspcc-dev/neo-go/pkg/vm/opcode"
-	"github.com/nspcc-dev/neo-go/pkg/vm/vmstate"
+	"github.com/nspcc-dev/neo-go/pkg/vm/stackitem"
 	"github.com/spf13/viper"
 )
 
@@ -39,44 +39,24 @@ const (
 	frostfsContract    = "frostfs"    // not deployed in side-chain.
 	processingContract = "processing" // not deployed in side-chain.
 	alphabetContract   = "alphabet"
-	auditContract      = "audit"
 	balanceContract    = "balance"
 	containerContract  = "container"
 	frostfsIDContract  = "frostfsid"
 	netmapContract     = "netmap"
+	policyContract     = "policy"
 	proxyContract      = "proxy"
-	reputationContract = "reputation"
-	subnetContract     = "subnet"
 )
 
-const (
-	netmapEpochKey                   = "EpochDuration"
-	netmapMaxObjectSizeKey           = "MaxObjectSize"
-	netmapAuditFeeKey                = "AuditFee"
-	netmapContainerFeeKey            = "ContainerFee"
-	netmapContainerAliasFeeKey       = "ContainerAliasFee"
-	netmapEigenTrustIterationsKey    = "EigenTrustIterations"
-	netmapEigenTrustAlphaKey         = "EigenTrustAlpha"
-	netmapBasicIncomeRateKey         = "BasicIncomeRate"
-	netmapInnerRingCandidateFeeKey   = "InnerRingCandidateFee"
-	netmapWithdrawFeeKey             = "WithdrawFee"
-	netmapHomomorphicHashDisabledKey = "HomomorphicHashingDisabled"
-	netmapMaintenanceAllowedKey      = "MaintenanceModeAllowed"
-
-	defaultEigenTrustIterations = 4
-	defaultEigenTrustAlpha      = "0.1"
-)
+const frostfsIDAuthorizedKeysConfigKey = "frostfsid.authorized_keys"
 
 var (
 	contractList = []string{
-		auditContract,
 		balanceContract,
 		containerContract,
 		frostfsIDContract,
 		netmapContract,
+		policyContract,
 		proxyContract,
-		reputationContract,
-		subnetContract,
 	}
 
 	fullContractList = append([]string{
@@ -85,6 +65,17 @@ var (
 		nnsContract,
 		alphabetContract,
 	}, contractList...)
+
+	netmapConfigKeys = []string{
+		netmap.EpochDurationConfig,
+		netmap.MaxObjectSizeConfig,
+		netmap.ContainerFeeConfig,
+		netmap.ContainerAliasFeeConfig,
+		netmap.IrCandidateFeeConfig,
+		netmap.WithdrawFeeConfig,
+		netmap.HomomorphicHashingDisabledKey,
+		netmap.MaintenanceModeAllowedConfig,
+	}
 )
 
 type contractState struct {
@@ -105,7 +96,10 @@ func (c *initializeContext) deployNNS(method string) error {
 	h := cs.Hash
 
 	nnsCs, err := c.nnsContractState()
-	if err == nil {
+	if err != nil {
+		return err
+	}
+	if nnsCs != nil {
 		if nnsCs.NEF.Checksum == cs.NEF.Checksum {
 			if method == deployMethodName {
 				c.Command.Println("NNS contract is already deployed.")
@@ -123,28 +117,13 @@ func (c *initializeContext) deployNNS(method string) error {
 	}
 
 	params := getContractDeployParameters(cs, nil)
-	signer := transaction.Signer{
-		Account: c.CommitteeAcc.Contract.ScriptHash(),
-		Scopes:  transaction.CalledByEntry,
-	}
 
 	invokeHash := management.Hash
 	if method == updateMethodName {
 		invokeHash = nnsCs.Hash
 	}
 
-	res, err := invokeFunction(c.Client, invokeHash, method, params, []transaction.Signer{signer})
-	if err != nil {
-		return fmt.Errorf("can't deploy NNS contract: %w", err)
-	}
-	if res.State != vmstate.Halt.String() {
-		return fmt.Errorf("can't deploy NNS contract: %s", res.FaultException)
-	}
-
-	tx, err := c.Client.CreateTxFromScript(res.Script, c.CommitteeAcc, res.GasConsumed, 0, []rpcclient.SignerAccount{{
-		Signer:  signer,
-		Account: c.CommitteeAcc,
-	}})
+	tx, err := c.CommitteeAct.MakeCall(invokeHash, method, params...)
 	if err != nil {
 		return fmt.Errorf("failed to create deploy tx for %s: %w", nnsContract, err)
 	}
@@ -239,7 +218,7 @@ func (c *initializeContext) deployOrUpdateContracts(w *io2.BufBinWriter, nnsHash
 			invokeHash = ctrHash
 		}
 
-		params := getContractDeployParameters(cs, c.getContractDeployData(ctrName, keysParam))
+		params := getContractDeployParameters(cs, c.getContractDeployData(ctrName, keysParam, updateMethodName))
 		res, err := c.CommitteeAct.MakeCall(invokeHash, method, params...)
 		if err != nil {
 			if method != updateMethodName || !strings.Contains(err.Error(), common.ErrAlreadyUpdated) {
@@ -362,7 +341,7 @@ func (c *initializeContext) deployContracts() error {
 			return fmt.Errorf("can't sign manifest group: %v", err)
 		}
 
-		params := getContractDeployParameters(cs, c.getContractDeployData(ctrName, keysParam))
+		params := getContractDeployParameters(cs, c.getContractDeployData(ctrName, keysParam, deployMethodName))
 		res, err := c.CommitteeAct.MakeCall(management.Hash, deployMethodName, params...)
 		if err != nil {
 			return fmt.Errorf("can't deploy %s contract: %w", ctrName, err)
@@ -377,8 +356,9 @@ func (c *initializeContext) deployContracts() error {
 }
 
 func (c *initializeContext) isUpdated(ctrHash util.Uint160, cs *contractState) bool {
-	realCs, err := c.Client.GetContractStateByHash(ctrHash)
-	return err == nil && realCs.NEF.Checksum == cs.NEF.Checksum
+	r := management.NewReader(c.ReadOnlyInvoker)
+	realCs, err := r.GetContract(ctrHash)
+	return err == nil && realCs != nil && realCs.NEF.Checksum == cs.NEF.Checksum
 }
 
 func (c *initializeContext) getContract(ctrName string) *contractState {
@@ -408,11 +388,9 @@ func (c *initializeContext) readContracts(names []string) error {
 	} else {
 		var r io.ReadCloser
 		if c.ContractPath == "" {
-			c.Command.Println("Contracts flag is missing, latest release will be fetched from Github.")
-			r, err = downloadContractsFromGithub(c.Command)
-		} else {
-			r, err = os.Open(c.ContractPath)
+			return errors.New("contracts flag is missing")
 		}
+		r, err = os.Open(c.ContractPath)
 		if err != nil {
 			return fmt.Errorf("can't open contracts archive: %w", err)
 		}
@@ -529,9 +507,8 @@ func getContractDeployParameters(cs *contractState, deployData []any) []any {
 	return []any{cs.RawNEF, cs.RawManifest, deployData}
 }
 
-func (c *initializeContext) getContractDeployData(ctrName string, keysParam []any) []any {
-	items := make([]any, 1, 6)
-	items[0] = false // notaryDisabled is false
+func (c *initializeContext) getContractDeployData(ctrName string, keysParam []any, method string) []any {
+	items := make([]any, 0, 6)
 
 	switch ctrName {
 	case frostfsContract:
@@ -542,8 +519,6 @@ func (c *initializeContext) getContractDeployData(ctrName string, keysParam []an
 	case processingContract:
 		items = append(items, c.Contracts[frostfsContract].Hash)
 		return items[1:] // no notary info
-	case auditContract:
-		items = append(items, c.Contracts[netmapContract].Hash)
 	case balanceContract:
 		items = append(items,
 			c.Contracts[netmapContract].Hash,
@@ -551,7 +526,8 @@ func (c *initializeContext) getContractDeployData(ctrName string, keysParam []an
 	case containerContract:
 		// In case if NNS is updated multiple times, we can't calculate
 		// it's actual hash based on local data, thus query chain.
-		nnsCs, err := c.Client.GetContractStateByID(1)
+		r := management.NewReader(c.ReadOnlyInvoker)
+		nnsCs, err := r.GetContractByID(1)
 		if err != nil {
 			panic("NNS is not yet deployed")
 		}
@@ -562,24 +538,38 @@ func (c *initializeContext) getContractDeployData(ctrName string, keysParam []an
 			nnsCs.Hash,
 			"container")
 	case frostfsIDContract:
-		items = append(items,
-			c.Contracts[netmapContract].Hash,
-			c.Contracts[containerContract].Hash)
-	case netmapContract:
-		configParam := []any{
-			netmapEpochKey, viper.GetInt64(epochDurationInitFlag),
-			netmapMaxObjectSizeKey, viper.GetInt64(maxObjectSizeInitFlag),
-			netmapAuditFeeKey, viper.GetInt64(auditFeeInitFlag),
-			netmapContainerFeeKey, viper.GetInt64(containerFeeInitFlag),
-			netmapContainerAliasFeeKey, viper.GetInt64(containerAliasFeeInitFlag),
-			netmapEigenTrustIterationsKey, int64(defaultEigenTrustIterations),
-			netmapEigenTrustAlphaKey, defaultEigenTrustAlpha,
-			netmapBasicIncomeRateKey, viper.GetInt64(incomeRateInitFlag),
-			netmapInnerRingCandidateFeeKey, viper.GetInt64(candidateFeeInitFlag),
-			netmapWithdrawFeeKey, viper.GetInt64(withdrawFeeInitFlag),
-			netmapHomomorphicHashDisabledKey, viper.GetBool(homomorphicHashDisabledInitFlag),
-			netmapMaintenanceAllowedKey, viper.GetBool(maintenanceModeAllowedInitFlag),
+		hs, err := getFrostfsIDAuthorizedKeys(viper.GetViper(), c.CommitteeAcc.PublicKey().GetScriptHash())
+		if err != nil {
+			panic(err)
 		}
+
+		items = append(items, hs)
+	case netmapContract:
+		md := getDefaultNetmapContractConfigMap()
+		if method == updateMethodName {
+			arr, err := c.getNetConfigFromNetmapContract()
+			if err != nil {
+				panic(err)
+			}
+			m, err := parseConfigFromNetmapContract(arr)
+			if err != nil {
+				panic(err)
+			}
+			for k, v := range m {
+				for _, key := range netmapConfigKeys {
+					if k == key {
+						md[k] = v
+						break
+					}
+				}
+			}
+		}
+
+		var configParam []any
+		for k, v := range md {
+			configParam = append(configParam, k, v)
+		}
+
 		items = append(items,
 			c.Contracts[balanceContract].Hash,
 			c.Contracts[containerContract].Hash,
@@ -587,21 +577,37 @@ func (c *initializeContext) getContractDeployData(ctrName string, keysParam []an
 			configParam)
 	case proxyContract:
 		items = nil
-	case reputationContract:
-	case subnetContract:
+	case policyContract:
+		items = []any{nil}
 	default:
 		panic(fmt.Sprintf("invalid contract name: %s", ctrName))
 	}
 	return items
 }
 
+func (c *initializeContext) getNetConfigFromNetmapContract() ([]stackitem.Item, error) {
+	r := management.NewReader(c.ReadOnlyInvoker)
+	cs, err := r.GetContractByID(1)
+	if err != nil {
+		return nil, fmt.Errorf("NNS is not yet deployed: %w", err)
+	}
+	nmHash, err := nnsResolveHash(c.ReadOnlyInvoker, cs.Hash, netmapContract+".frostfs")
+	if err != nil {
+		return nil, fmt.Errorf("can't get netmap contract hash: %w", err)
+	}
+	arr, err := unwrap.Array(c.ReadOnlyInvoker.Call(nmHash, "listConfig"))
+	if err != nil {
+		return nil, fmt.Errorf("can't fetch list of network config keys from the netmap contract")
+	}
+	return arr, err
+}
+
 func (c *initializeContext) getAlphabetDeployItems(i, n int) []any {
-	items := make([]any, 6)
-	items[0] = false
-	items[1] = c.Contracts[netmapContract].Hash
-	items[2] = c.Contracts[proxyContract].Hash
-	items[3] = innerring.GlagoliticLetter(i).String()
-	items[4] = int64(i)
-	items[5] = int64(n)
+	items := make([]any, 5)
+	items[0] = c.Contracts[netmapContract].Hash
+	items[1] = c.Contracts[proxyContract].Hash
+	items[2] = innerring.GlagoliticLetter(i).String()
+	items[3] = int64(i)
+	items[4] = int64(n)
 	return items
 }

cmd/frostfs-adm/internal/modules/morph/initialize_nns.go

@@ -15,6 +15,8 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/io"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
+	nnsClient "github.com/nspcc-dev/neo-go/pkg/rpcclient/nns"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/util"
@@ -26,8 +28,11 @@ import (
 
 const defaultExpirationTime = 10 * 365 * 24 * time.Hour / time.Second
 
+const frostfsOpsEmail = "ops@frostfs.info"
+
 func (c *initializeContext) setNNS() error {
-	nnsCs, err := c.Client.GetContractStateByID(1)
+	r := management.NewReader(c.ReadOnlyInvoker)
+	nnsCs, err := r.GetContractByID(1)
 	if err != nil {
 		return err
 	}
@@ -39,7 +44,7 @@ func (c *initializeContext) setNNS() error {
 		bw := io.NewBufBinWriter()
 		emit.AppCall(bw.BinWriter, nnsCs.Hash, "register", callflag.All,
 			"frostfs", c.CommitteeAcc.Contract.ScriptHash(),
-			"ops@nspcc.ru", int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
+			frostfsOpsEmail, int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
 		emit.Opcodes(bw.BinWriter, opcode.ASSERT)
 		if err := c.sendCommitteeTx(bw.Bytes(), true); err != nil {
 			return fmt.Errorf("can't add domain root to NNS: %w", err)
@@ -121,7 +126,7 @@ func (c *initializeContext) emitUpdateNNSGroupScript(bw *io.BufBinWriter, nnsHas
 	if isAvail {
 		emit.AppCall(bw.BinWriter, nnsHash, "register", callflag.All,
 			morphClient.NNSGroupKeyName, c.CommitteeAcc.Contract.ScriptHash(),
-			"ops@nspcc.ru", int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
+			frostfsOpsEmail, int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
 		emit.Opcodes(bw.BinWriter, opcode.ASSERT)
 	}
 
@@ -169,7 +174,7 @@ func (c *initializeContext) nnsRegisterDomainScript(nnsHash, expectedHash util.U
 		bw := io.NewBufBinWriter()
 		emit.AppCall(bw.BinWriter, nnsHash, "register", callflag.All,
 			domain, c.CommitteeAcc.Contract.ScriptHash(),
-			"ops@nspcc.ru", int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
+			frostfsOpsEmail, int64(3600), int64(600), int64(defaultExpirationTime), int64(3600))
 		emit.Opcodes(bw.BinWriter, opcode.ASSERT)
 
 		if bw.Err != nil {
@@ -284,10 +289,11 @@ func parseNNSResolveResult(res stackitem.Item) (util.Uint160, error) {
 }
 
 func nnsIsAvailable(c Client, nnsHash util.Uint160, name string) (bool, error) {
-	switch ct := c.(type) {
+	switch c.(type) {
 	case *rpcclient.Client:
-		//lint:ignore SA1019 https://git.frostfs.info/TrueCloudLab/frostfs-node/issues/202
-		return ct.NNSIsAvailable(nnsHash, name)
+		inv := invoker.New(c, nil)
+		reader := nnsClient.NewReader(inv, nnsHash)
+		return reader.IsAvailable(name)
 	default:
 		b, err := unwrap.Bool(invokeFunction(c, nnsHash, "isAvailable", []any{name}, nil))
 		if err != nil {

cmd/frostfs-adm/internal/modules/morph/initialize_register.go

@@ -3,13 +3,17 @@ package morph
 import (
 	"errors"
 	"fmt"
+	"math/big"
 
 	"github.com/nspcc-dev/neo-go/pkg/core/native"
 	"github.com/nspcc-dev/neo-go/pkg/core/state"
 	"github.com/nspcc-dev/neo-go/pkg/core/transaction"
 	"github.com/nspcc-dev/neo-go/pkg/io"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/neo"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/nep17"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/util"
@@ -18,53 +22,48 @@ import (
 )
 
 // initialAlphabetNEOAmount represents the total amount of GAS distributed between alphabet nodes.
-const initialAlphabetNEOAmount = native.NEOTotalSupply
-
-func (c *initializeContext) registerCandidates() error {
-	neoHash := neo.Hash
-
-	cc, err := unwrap.Array(c.ReadOnlyInvoker.Call(neoHash, "getCandidates"))
-	if err != nil {
-		return fmt.Errorf("`getCandidates`: %w", err)
-	}
-
-	if len(cc) > 0 {
-		c.Command.Println("Candidates are already registered.")
-		return nil
-	}
+const (
+	initialAlphabetNEOAmount = native.NEOTotalSupply
+	registerBatchSize        = transaction.MaxAttributes - 1
+)
 
+func (c *initializeContext) registerCandidateRange(start, end int) error {
 	regPrice, err := c.getCandidateRegisterPrice()
 	if err != nil {
 		return fmt.Errorf("can't fetch registration price: %w", err)
 	}
 
 	w := io.NewBufBinWriter()
-	emit.AppCall(w.BinWriter, neoHash, "setRegisterPrice", callflag.States, 1)
-	for _, acc := range c.Accounts {
-		emit.AppCall(w.BinWriter, neoHash, "registerCandidate", callflag.States, acc.PrivateKey().PublicKey().Bytes())
+	emit.AppCall(w.BinWriter, neo.Hash, "setRegisterPrice", callflag.States, 1)
+	for _, acc := range c.Accounts[start:end] {
+		emit.AppCall(w.BinWriter, neo.Hash, "registerCandidate", callflag.States, acc.PrivateKey().PublicKey().Bytes())
 		emit.Opcodes(w.BinWriter, opcode.ASSERT)
 	}
-	emit.AppCall(w.BinWriter, neoHash, "setRegisterPrice", callflag.States, regPrice)
+	emit.AppCall(w.BinWriter, neo.Hash, "setRegisterPrice", callflag.States, regPrice)
 	if w.Err != nil {
 		panic(fmt.Sprintf("BUG: %v", w.Err))
 	}
 
-	signers := []rpcclient.SignerAccount{{
+	signers := []actor.SignerAccount{{
 		Signer:  c.getSigner(false, c.CommitteeAcc),
 		Account: c.CommitteeAcc,
 	}}
-	for i := range c.Accounts {
-		signers = append(signers, rpcclient.SignerAccount{
+	for _, acc := range c.Accounts[start:end] {
+		signers = append(signers, actor.SignerAccount{
 			Signer: transaction.Signer{
-				Account:          c.Accounts[i].Contract.ScriptHash(),
+				Account:          acc.Contract.ScriptHash(),
 				Scopes:           transaction.CustomContracts,
-				AllowedContracts: []util.Uint160{neoHash},
+				AllowedContracts: []util.Uint160{neo.Hash},
 			},
-			Account: c.Accounts[i],
+			Account: acc,
 		})
 	}
 
-	tx, err := c.Client.CreateTxFromScript(w.Bytes(), c.CommitteeAcc, -1, 0, signers)
+	act, err := actor.New(c.Client, signers)
+	if err != nil {
+		return fmt.Errorf("can't create actor: %w", err)
+	}
+	tx, err := act.MakeRun(w.Bytes())
 	if err != nil {
 		return fmt.Errorf("can't create tx: %w", err)
 	}
@@ -73,8 +72,8 @@ func (c *initializeContext) registerCandidates() error {
 	}
 
 	network := c.CommitteeAct.GetNetwork()
-	for i := range c.Accounts {
-		if err := c.Accounts[i].SignTx(network, tx); err != nil {
+	for _, acc := range c.Accounts[start:end] {
+		if err := acc.SignTx(network, tx); err != nil {
 			return fmt.Errorf("can't sign a transaction: %w", err)
 		}
 	}
@@ -82,6 +81,39 @@ func (c *initializeContext) registerCandidates() error {
 	return c.sendTx(tx, c.Command, true)
 }
 
+func (c *initializeContext) registerCandidates() error {
+	cc, err := unwrap.Array(c.ReadOnlyInvoker.Call(neo.Hash, "getCandidates"))
+	if err != nil {
+		return fmt.Errorf("`getCandidates`: %w", err)
+	}
+
+	need := len(c.Accounts)
+	have := len(cc)
+
+	if need == have {
+		c.Command.Println("Candidates are already registered.")
+		return nil
+	}
+
+	// Register candidates in batches in order to overcome the signers amount limit.
+	// See: https://github.com/nspcc-dev/neo-go/blob/master/pkg/core/transaction/transaction.go#L27
+	for i := 0; i < need; i += registerBatchSize {
+		start, end := i, i+registerBatchSize
+		if end > need {
+			end = need
+		}
+		// This check is sound because transactions are accepted/rejected atomically.
+		if have >= end {
+			continue
+		}
+		if err := c.registerCandidateRange(start, end); err != nil {
+			return fmt.Errorf("registering candidates %d..%d: %q", start, end-1, err)
+		}
+	}
+
+	return nil
+}
+
 func (c *initializeContext) transferNEOToAlphabetContracts() error {
 	neoHash := neo.Hash
 
@@ -109,17 +141,19 @@ func (c *initializeContext) transferNEOToAlphabetContracts() error {
 }
 
 func (c *initializeContext) transferNEOFinished(neoHash util.Uint160) (bool, error) {
-	bal, err := c.Client.NEP17BalanceOf(neoHash, c.CommitteeAcc.Contract.ScriptHash())
-	return bal < native.NEOTotalSupply, err
+	r := nep17.NewReader(c.ReadOnlyInvoker, neoHash)
+	bal, err := r.BalanceOf(c.CommitteeAcc.Contract.ScriptHash())
+	return bal.Cmp(big.NewInt(native.NEOTotalSupply)) == -1, err
 }
 
 var errGetPriceInvalid = errors.New("`getRegisterPrice`: invalid response")
 
 func (c *initializeContext) getCandidateRegisterPrice() (int64, error) {
-	switch ct := c.Client.(type) {
+	switch c.Client.(type) {
 	case *rpcclient.Client:
-		//lint:ignore SA1019 https://git.frostfs.info/TrueCloudLab/frostfs-node/issues/202
-		return ct.GetCandidateRegisterPrice()
+		inv := invoker.New(c.Client, nil)
+		reader := neo.NewReader(inv)
+		return reader.GetRegisterPrice()
 	default:
 		neoHash := neo.Hash
 		res, err := invokeFunction(c.Client, neoHash, "getRegisterPrice", nil, nil)

cmd/frostfs-adm/internal/modules/morph/initialize_test.go

@@ -2,10 +2,12 @@ package morph
 
 import (
 	"encoding/hex"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"testing"
+	"time"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/innerring"
 	"github.com/nspcc-dev/neo-go/pkg/config"
@@ -18,7 +20,7 @@ import (
 )
 
 const (
-	contractsPath = "../../../../../../frostfs-contract/frostfs-contract-v0.16.0.tar.gz"
+	contractsPath = "../../../../../../contract/frostfs-contract-v0.18.0.tar.gz"
 	protoFileName = "proto.yml"
 )
 
@@ -36,18 +38,29 @@ func TestInitialize(t *testing.T) {
 	t.Run("7 nodes", func(t *testing.T) {
 		testInitialize(t, 7)
 	})
+	t.Run("16 nodes", func(t *testing.T) {
+		testInitialize(t, 16)
+	})
+	t.Run("max nodes", func(t *testing.T) {
+		testInitialize(t, maxAlphabetNodes)
+	})
+	t.Run("too many nodes", func(t *testing.T) {
+		require.ErrorIs(t, generateTestData(t, t.TempDir(), maxAlphabetNodes+1), ErrTooManyAlphabetNodes)
+	})
 }
 
 func testInitialize(t *testing.T, committeeSize int) {
 	testdataDir := t.TempDir()
 	v := viper.GetViper()
 
-	generateTestData(t, testdataDir, committeeSize)
+	require.NoError(t, generateTestData(t, testdataDir, committeeSize))
 	v.Set(protoConfigPath, filepath.Join(testdataDir, protoFileName))
 
 	// Set to the path or remove the next statement to download from the network.
 	require.NoError(t, initCmd.Flags().Set(contractsInitFlag, contractsPath))
-	v.Set(localDumpFlag, filepath.Join(testdataDir, "out"))
+
+	dumpPath := filepath.Join(testdataDir, "out")
+	require.NoError(t, initCmd.Flags().Set(localDumpFlag, dumpPath))
 	v.Set(alphabetWalletsFlag, testdataDir)
 	v.Set(epochDurationInitFlag, 1)
 	v.Set(maxObjectSizeInitFlag, 1024)
@@ -56,12 +69,15 @@ func testInitialize(t *testing.T, committeeSize int) {
 	require.NoError(t, initializeSideChainCmd(initCmd, nil))
 
 	t.Run("force-new-epoch", func(t *testing.T) {
+		require.NoError(t, forceNewEpoch.Flags().Set(localDumpFlag, dumpPath))
 		require.NoError(t, forceNewEpochCmd(forceNewEpoch, nil))
 	})
 	t.Run("set-config", func(t *testing.T) {
+		require.NoError(t, setConfig.Flags().Set(localDumpFlag, dumpPath))
 		require.NoError(t, setConfigCmd(setConfig, []string{"MaintenanceModeAllowed=true"}))
 	})
 	t.Run("set-policy", func(t *testing.T) {
+		require.NoError(t, setPolicy.Flags().Set(localDumpFlag, dumpPath))
 		require.NoError(t, setPolicyCmd(setPolicy, []string{"ExecFeeFactor=1"}))
 	})
 	t.Run("remove-node", func(t *testing.T) {
@@ -69,29 +85,38 @@ func testInitialize(t *testing.T, committeeSize int) {
 		require.NoError(t, err)
 
 		pub := hex.EncodeToString(pk.PublicKey().Bytes())
+		require.NoError(t, removeNodes.Flags().Set(localDumpFlag, dumpPath))
 		require.NoError(t, removeNodesCmd(removeNodes, []string{pub}))
 	})
 }
 
-func generateTestData(t *testing.T, dir string, size int) {
+func generateTestData(t *testing.T, dir string, size int) error {
 	v := viper.GetViper()
 	v.Set(alphabetWalletsFlag, dir)
 
 	sizeStr := strconv.FormatUint(uint64(size), 10)
-	require.NoError(t, generateAlphabetCmd.Flags().Set(alphabetSizeFlag, sizeStr))
+	if err := generateAlphabetCmd.Flags().Set(alphabetSizeFlag, sizeStr); err != nil {
+		return err
+	}
 
 	setTestCredentials(v, size)
-	require.NoError(t, generateAlphabetCreds(generateAlphabetCmd, nil))
+	if err := generateAlphabetCreds(generateAlphabetCmd, nil); err != nil {
+		return err
+	}
 
 	var pubs []string
 	for i := 0; i < size; i++ {
 		p := filepath.Join(dir, innerring.GlagoliticLetter(i).String()+".json")
 		w, err := wallet.NewWalletFromFile(p)
-		require.NoError(t, err, "wallet doesn't exist")
+		if err != nil {
+			return fmt.Errorf("wallet doesn't exist: %w", err)
+		}
 		for _, acc := range w.Accounts {
 			if acc.Label == singleAccountName {
 				pub, ok := vm.ParseSignatureContract(acc.Contract.Script)
-				require.True(t, ok)
+				if !ok {
+					return fmt.Errorf("could not parse signature script for %s", acc.Address)
+				}
 				pubs = append(pubs, hex.EncodeToString(pub))
 				continue
 			}
@@ -100,17 +125,18 @@ func generateTestData(t *testing.T, dir string, size int) {
 
 	cfg := config.Config{}
 	cfg.ProtocolConfiguration.Magic = 12345
-	cfg.ProtocolConfiguration.ValidatorsCount = size
-	cfg.ProtocolConfiguration.SecondsPerBlock = 1     //lint:ignore SA1019 https://git.frostfs.info/TrueCloudLab/frostfs-node/issues/202
+	cfg.ProtocolConfiguration.ValidatorsCount = uint32(size)
+	cfg.ProtocolConfiguration.TimePerBlock = time.Second
 	cfg.ProtocolConfiguration.StandbyCommittee = pubs // sorted by glagolic letters
 	cfg.ProtocolConfiguration.P2PSigExtensions = true
 	cfg.ProtocolConfiguration.VerifyTransactions = true
-	cfg.ProtocolConfiguration.VerifyBlocks = true //lint:ignore SA1019 https://git.frostfs.info/TrueCloudLab/frostfs-node/issues/202
 	data, err := yaml.Marshal(cfg)
-	require.NoError(t, err)
+	if err != nil {
+		return err
+	}
 
 	protoPath := filepath.Join(dir, protoFileName)
-	require.NoError(t, os.WriteFile(protoPath, data, os.ModePerm))
+	return os.WriteFile(protoPath, data, os.ModePerm)
 }
 
 func setTestCredentials(v *viper.Viper, size int) {
@@ -119,3 +145,38 @@ func setTestCredentials(v *viper.Viper, size int) {
 	}
 	v.Set("credentials.contract", testContractPassword)
 }
+
+func TestNextPollInterval(t *testing.T) {
+	var pollInterval time.Duration
+	var iteration int
+
+	pollInterval, hasChanged := nextPollInterval(iteration, pollInterval)
+	require.True(t, hasChanged)
+	require.Equal(t, time.Second, pollInterval)
+
+	iteration = 4
+	pollInterval, hasChanged = nextPollInterval(iteration, pollInterval)
+	require.False(t, hasChanged)
+	require.Equal(t, time.Second, pollInterval)
+
+	iteration = 5
+	pollInterval, hasChanged = nextPollInterval(iteration, pollInterval)
+	require.True(t, hasChanged)
+	require.Equal(t, 2*time.Second, pollInterval)
+
+	iteration = 10
+	pollInterval, hasChanged = nextPollInterval(iteration, pollInterval)
+	require.True(t, hasChanged)
+	require.Equal(t, 4*time.Second, pollInterval)
+
+	iteration = 20
+	pollInterval = 32 * time.Second
+	pollInterval, hasChanged = nextPollInterval(iteration, pollInterval)
+	require.True(t, hasChanged) // from 32s to 16s
+	require.Equal(t, 16*time.Second, pollInterval)
+
+	pollInterval = 16 * time.Second
+	pollInterval, hasChanged = nextPollInterval(iteration, pollInterval)
+	require.False(t, hasChanged)
+	require.Equal(t, 16*time.Second, pollInterval)
+}

cmd/frostfs-adm/internal/modules/morph/initialize_transfer.go

@@ -2,15 +2,18 @@ package morph
 
 import (
 	"fmt"
+	"math/big"
 
 	"github.com/nspcc-dev/neo-go/pkg/core/native"
 	"github.com/nspcc-dev/neo-go/pkg/core/transaction"
 	"github.com/nspcc-dev/neo-go/pkg/io"
-	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/gas"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/neo"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/nep17"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	scContext "github.com/nspcc-dev/neo-go/pkg/smartcontract/context"
+	"github.com/nspcc-dev/neo-go/pkg/util"
 	"github.com/nspcc-dev/neo-go/pkg/vm/emit"
 	"github.com/nspcc-dev/neo-go/pkg/vm/opcode"
 	"github.com/nspcc-dev/neo-go/pkg/wallet"
@@ -33,11 +36,11 @@ func (c *initializeContext) transferFunds() error {
 		return err
 	}
 
-	var transfers []rpcclient.TransferTarget
+	var transfers []transferTarget
 	for _, acc := range c.Accounts {
 		to := acc.Contract.ScriptHash()
 		transfers = append(transfers,
-			rpcclient.TransferTarget{
+			transferTarget{
 				Token:   gas.Hash,
 				Address: to,
 				Amount:  initialAlphabetGASAmount,
@@ -47,25 +50,19 @@ func (c *initializeContext) transferFunds() error {
 
 	// It is convenient to have all funds at the committee account.
 	transfers = append(transfers,
-		rpcclient.TransferTarget{
+		transferTarget{
 			Token:   gas.Hash,
 			Address: c.CommitteeAcc.Contract.ScriptHash(),
 			Amount:  (gasInitialTotalSupply - initialAlphabetGASAmount*int64(len(c.Wallets))) / 2,
 		},
-		rpcclient.TransferTarget{
+		transferTarget{
 			Token:   neo.Hash,
 			Address: c.CommitteeAcc.Contract.ScriptHash(),
 			Amount:  native.NEOTotalSupply,
 		},
 	)
 
-	tx, err := createNEP17MultiTransferTx(c.Client, c.ConsensusAcc, 0, transfers, []rpcclient.SignerAccount{{
-		Signer: transaction.Signer{
-			Account: c.ConsensusAcc.Contract.ScriptHash(),
-			Scopes:  transaction.CalledByEntry,
-		},
-		Account: c.ConsensusAcc,
-	}})
+	tx, err := createNEP17MultiTransferTx(c.Client, c.ConsensusAcc, transfers)
 	if err != nil {
 		return fmt.Errorf("can't create transfer transaction: %w", err)
 	}
@@ -80,8 +77,9 @@ func (c *initializeContext) transferFunds() error {
 func (c *initializeContext) transferFundsFinished() (bool, error) {
 	acc := c.Accounts[0]
 
-	res, err := c.Client.NEP17BalanceOf(gas.Hash, acc.Contract.ScriptHash())
-	return res > initialAlphabetGASAmount/2, err
+	r := nep17.NewReader(c.ReadOnlyInvoker, gas.Hash)
+	res, err := r.BalanceOf(acc.Contract.ScriptHash())
+	return res.Cmp(big.NewInt(initialAlphabetGASAmount/2)) == 1, err
 }
 
 func (c *initializeContext) multiSignAndSend(tx *transaction.Transaction, accType string) error {
@@ -93,12 +91,13 @@ func (c *initializeContext) multiSignAndSend(tx *transaction.Transaction, accTyp
 }
 
 func (c *initializeContext) multiSign(tx *transaction.Transaction, accType string) error {
-	network, err := c.Client.GetNetwork()
+	version, err := c.Client.GetVersion()
 	if err != nil {
 		// error appears only if client
 		// has not been initialized
 		panic(err)
 	}
+	network := version.Protocol.Network
 
 	// Use parameter context to avoid dealing with signature order.
 	pc := scContext.NewParameterContext("", network, tx)
@@ -146,16 +145,17 @@ func (c *initializeContext) multiSign(tx *transaction.Transaction, accType strin
 func (c *initializeContext) transferGASToProxy() error {
 	proxyCs := c.getContract(proxyContract)
 
-	bal, err := c.Client.NEP17BalanceOf(gas.Hash, proxyCs.Hash)
-	if err != nil || bal > 0 {
+	r := nep17.NewReader(c.ReadOnlyInvoker, gas.Hash)
+	bal, err := r.BalanceOf(proxyCs.Hash)
+	if err != nil || bal.Sign() > 0 {
 		return err
 	}
 
-	tx, err := createNEP17MultiTransferTx(c.Client, c.CommitteeAcc, 0, []rpcclient.TransferTarget{{
+	tx, err := createNEP17MultiTransferTx(c.Client, c.CommitteeAcc, []transferTarget{{
 		Token:   gas.Hash,
 		Address: proxyCs.Hash,
 		Amount:  initialProxyGASAmount,
-	}}, nil)
+	}})
 	if err != nil {
 		return err
 	}
@@ -167,8 +167,14 @@ func (c *initializeContext) transferGASToProxy() error {
 	return c.awaitTx()
 }
 
-func createNEP17MultiTransferTx(c Client, acc *wallet.Account, netFee int64,
-	recipients []rpcclient.TransferTarget, cosigners []rpcclient.SignerAccount) (*transaction.Transaction, error) {
+type transferTarget struct {
+	Token   util.Uint160
+	Address util.Uint160
+	Amount  int64
+	Data    any
+}
+
+func createNEP17MultiTransferTx(c Client, acc *wallet.Account, recipients []transferTarget) (*transaction.Transaction, error) {
 	from := acc.Contract.ScriptHash()
 
 	w := io.NewBufBinWriter()
@@ -180,11 +186,18 @@ func createNEP17MultiTransferTx(c Client, acc *wallet.Account, netFee int64,
 	if w.Err != nil {
 		return nil, fmt.Errorf("failed to create transfer script: %w", w.Err)
 	}
-	return c.CreateTxFromScript(w.Bytes(), acc, -1, netFee, append([]rpcclient.SignerAccount{{
+
+	signers := []actor.SignerAccount{{
 		Signer: transaction.Signer{
-			Account: from,
+			Account: acc.Contract.ScriptHash(),
 			Scopes:  transaction.CalledByEntry,
 		},
 		Account: acc,
-	}}, cosigners...))
+	}}
+
+	act, err := actor.New(c, signers)
+	if err != nil {
+		return nil, fmt.Errorf("can't create actor: %w", err)
+	}
+	return act.MakeRun(w.Bytes())
 }

cmd/frostfs-adm/internal/modules/morph/internal/types.go

@@ -1,65 +0,0 @@
-package internal
-
-import (
-	"fmt"
-	"strconv"
-
-	"google.golang.org/protobuf/proto"
-)
-
-// StringifySubnetClientGroupID returns string representation of SubnetClientGroupID using MarshalText.
-// Returns a string with a message on error.
-func StringifySubnetClientGroupID(id *SubnetClientGroupID) string {
-	text, err := id.MarshalText()
-	if err != nil {
-		return fmt.Sprintf("<invalid> %v", err)
-	}
-
-	return string(text)
-}
-
-// MarshalText encodes SubnetClientGroupID into text format according to FrostFS API V2 protocol:
-// value in base-10 integer string format.
-//
-// It implements encoding.TextMarshaler.
-func (x *SubnetClientGroupID) MarshalText() ([]byte, error) {
-	num := x.GetValue() // NPE safe, returns zero on nil
-
-	return []byte(strconv.FormatUint(uint64(num), 10)), nil
-}
-
-// UnmarshalText decodes the SubnetID from the text according to FrostFS API V2 protocol:
-// should be base-10 integer string format with bitsize = 32.
-//
-// Returns strconv.ErrRange if integer overflows uint32.
-//
-// Must not be called on nil.
-//
-// Implements encoding.TextUnmarshaler.
-func (x *SubnetClientGroupID) UnmarshalText(txt []byte) error {
-	num, err := strconv.ParseUint(string(txt), 10, 32)
-	if err != nil {
-		return fmt.Errorf("invalid numeric value: %w", err)
-	}
-
-	x.SetNumber(uint32(num))
-
-	return nil
-}
-
-// Marshal encodes the SubnetClientGroupID into a binary format of FrostFS API V2 protocol
-// (Protocol Buffers with direct field order).
-func (x *SubnetClientGroupID) Marshal() ([]byte, error) {
-	return proto.Marshal(x)
-}
-
-// Unmarshal decodes the SubnetClientGroupID from FrostFS API V2 binary format (see Marshal). Must not be called on nil.
-func (x *SubnetClientGroupID) Unmarshal(data []byte) error {
-	return proto.Unmarshal(data, x)
-}
-
-// SetNumber sets SubnetClientGroupID value in uint32 format. Must not be called on nil.
-// By default, number is 0.
-func (x *SubnetClientGroupID) SetNumber(num uint32) {
-	x.Value = num
-}

cmd/frostfs-adm/internal/modules/morph/internal/types.proto

@@ -1,15 +0,0 @@
-syntax = "proto3";
-
-package neo.fs.v2.refs;
-
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-adm/internal/modules/morph/internal";
-
-// Client group identifier in the FrostFS subnet.
-//
-// String representation of a value is base-10 integer.
-//
-// JSON representation is an object containing single `value` number field.
-message SubnetClientGroupID {
-  // 4-byte integer identifier of the subnet client group.
-  fixed32 value = 1 [json_name = "value"];
-}

cmd/frostfs-adm/internal/modules/morph/local_client.go

@@ -10,33 +10,28 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/nspcc-dev/neo-go/pkg/config"
-	"github.com/nspcc-dev/neo-go/pkg/config/netmode"
 	"github.com/nspcc-dev/neo-go/pkg/core"
 	"github.com/nspcc-dev/neo-go/pkg/core/block"
 	"github.com/nspcc-dev/neo-go/pkg/core/chaindump"
-	"github.com/nspcc-dev/neo-go/pkg/core/fee"
 	"github.com/nspcc-dev/neo-go/pkg/core/native/noderoles"
 	"github.com/nspcc-dev/neo-go/pkg/core/state"
 	"github.com/nspcc-dev/neo-go/pkg/core/storage"
 	"github.com/nspcc-dev/neo-go/pkg/core/transaction"
-	"github.com/nspcc-dev/neo-go/pkg/crypto/hash"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/nspcc-dev/neo-go/pkg/encoding/address"
-	"github.com/nspcc-dev/neo-go/pkg/encoding/fixedn"
 	"github.com/nspcc-dev/neo-go/pkg/io"
 	"github.com/nspcc-dev/neo-go/pkg/neorpc/result"
-	"github.com/nspcc-dev/neo-go/pkg/network/payload"
-	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
+	"github.com/nspcc-dev/neo-go/pkg/smartcontract/manifest"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/trigger"
 	"github.com/nspcc-dev/neo-go/pkg/util"
+	"github.com/nspcc-dev/neo-go/pkg/vm"
 	"github.com/nspcc-dev/neo-go/pkg/vm/emit"
 	"github.com/nspcc-dev/neo-go/pkg/vm/opcode"
 	"github.com/nspcc-dev/neo-go/pkg/vm/stackitem"
-	"github.com/nspcc-dev/neo-go/pkg/vm/vmstate"
 	"github.com/nspcc-dev/neo-go/pkg/wallet"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -51,7 +46,7 @@ type localClient struct {
 	maxGasInvoke int64
 }
 
-func newLocalClient(cmd *cobra.Command, v *viper.Viper, wallets []*wallet.Wallet) (*localClient, error) {
+func newLocalClient(cmd *cobra.Command, v *viper.Viper, wallets []*wallet.Wallet, dumpPath string) (*localClient, error) {
 	cfg, err := config.LoadFile(v.GetString(protoConfigPath))
 	if err != nil {
 		return nil, err
@@ -62,7 +57,7 @@ func newLocalClient(cmd *cobra.Command, v *viper.Viper, wallets []*wallet.Wallet
 		return nil, err
 	}
 
-	m := smartcontract.GetDefaultHonestNodeCount(cfg.ProtocolConfiguration.ValidatorsCount)
+	m := smartcontract.GetDefaultHonestNodeCount(int(cfg.ProtocolConfiguration.ValidatorsCount))
 	accounts := make([]*wallet.Account, len(wallets))
 	for i := range accounts {
 		accounts[i], err = getWalletAccount(wallets[i], consensusAccountName)
@@ -87,9 +82,8 @@ func newLocalClient(cmd *cobra.Command, v *viper.Viper, wallets []*wallet.Wallet
 
 	go bc.Run()
 
-	dumpPath := v.GetString(localDumpFlag)
 	if cmd.Name() != "init" {
-		f, err := os.OpenFile(dumpPath, os.O_RDONLY, 0600)
+		f, err := os.OpenFile(dumpPath, os.O_RDONLY, 0o600)
 		if err != nil {
 			return nil, fmt.Errorf("can't open local dump: %w", err)
 		}
@@ -120,29 +114,10 @@ func (l *localClient) GetBlockCount() (uint32, error) {
 	return l.bc.BlockHeight(), nil
 }
 
-func (l *localClient) GetContractStateByID(id int32) (*state.Contract, error) {
-	h, err := l.bc.GetContractScriptHash(id)
-	if err != nil {
-		return nil, err
-	}
-	return l.GetContractStateByHash(h)
-}
-
-func (l *localClient) GetContractStateByHash(h util.Uint160) (*state.Contract, error) {
-	if cs := l.bc.GetContractState(h); cs != nil {
-		return cs, nil
-	}
-	return nil, storage.ErrKeyNotFound
-}
-
 func (l *localClient) GetNativeContracts() ([]state.NativeContract, error) {
 	return l.bc.GetNatives(), nil
 }
 
-func (l *localClient) GetNetwork() (netmode.Magic, error) {
-	return l.bc.GetConfig().Magic, nil
-}
-
 func (l *localClient) GetApplicationLog(h util.Uint256, t *trigger.Type) (*result.ApplicationLog, error) {
 	aer, err := l.bc.GetAppExecResults(h, *t)
 	if err != nil {
@@ -153,34 +128,6 @@ func (l *localClient) GetApplicationLog(h util.Uint256, t *trigger.Type) (*resul
 	return &a, nil
 }
 
-func (l *localClient) CreateTxFromScript(script []byte, acc *wallet.Account, sysFee int64, netFee int64, cosigners []rpcclient.SignerAccount) (*transaction.Transaction, error) {
-	signers, accounts, err := getSigners(acc, cosigners)
-	if err != nil {
-		return nil, fmt.Errorf("failed to construct tx signers: %w", err)
-	}
-	if sysFee < 0 {
-		res, err := l.InvokeScript(script, signers)
-		if err != nil {
-			return nil, fmt.Errorf("can't add system fee to transaction: %w", err)
-		}
-		if res.State != "HALT" {
-			return nil, fmt.Errorf("can't add system fee to transaction: bad vm state: %s due to an error: %s", res.State, res.FaultException)
-		}
-		sysFee = res.GasConsumed
-	}
-
-	tx := transaction.New(script, sysFee)
-	tx.Signers = signers
-	tx.ValidUntilBlock = l.bc.BlockHeight() + 2
-
-	err = l.AddNetworkFee(tx, netFee, accounts...)
-	if err != nil {
-		return nil, fmt.Errorf("failed to add network fee: %w", err)
-	}
-
-	return tx, nil
-}
-
 func (l *localClient) GetCommittee() (keys.PublicKeys, error) {
 	// not used by `morph init` command
 	panic("unexpected call")
@@ -201,21 +148,6 @@ func (l *localClient) InvokeFunction(h util.Uint160, method string, sPrm []smart
 	return invokeFunction(l, h, method, pp, ss)
 }
 
-func (l *localClient) CalculateNotaryFee(_ uint8) (int64, error) {
-	// not used by `morph init` command
-	panic("unexpected call")
-}
-
-func (l *localClient) SignAndPushP2PNotaryRequest(_ *transaction.Transaction, _ []byte, _ int64, _ int64, _ uint32, _ *wallet.Account) (*payload.P2PNotaryRequest, error) {
-	// not used by `morph init` command
-	panic("unexpected call")
-}
-
-func (l *localClient) SignAndPushInvocationTx(_ []byte, _ *wallet.Account, _ int64, _ fixedn.Fixed8, _ []rpcclient.SignerAccount) (util.Uint256, error) {
-	// not used by `morph init` command
-	panic("unexpected call")
-}
-
 func (l *localClient) TerminateSession(_ uuid.UUID) (bool, error) {
 	// not used by `morph init` command
 	panic("unexpected call")
@@ -248,117 +180,83 @@ func (l *localClient) GetVersion() (*result.Version, error) {
 	}, nil
 }
 
-func (l *localClient) InvokeContractVerify(contract util.Uint160, params []smartcontract.Parameter, signers []transaction.Signer, witnesses ...transaction.Witness) (*result.Invoke, error) {
+func (l *localClient) InvokeContractVerify(util.Uint160, []smartcontract.Parameter, []transaction.Signer, ...transaction.Witness) (*result.Invoke, error) {
 	// not used by `morph init` command
 	panic("unexpected call")
 }
 
 // CalculateNetworkFee calculates network fee for the given transaction.
 // Copied from neo-go with minor corrections (no need to support non-notary mode):
-// https://github.com/nspcc-dev/neo-go/blob/v0.99.2/pkg/services/rpcsrv/server.go#L744
+// https://github.com/nspcc-dev/neo-go/blob/v0.103.0/pkg/services/rpcsrv/server.go#L911
 func (l *localClient) CalculateNetworkFee(tx *transaction.Transaction) (int64, error) {
-	hashablePart, err := tx.EncodeHashableFields()
-	if err != nil {
-		return 0, fmt.Errorf("failed to compute tx size: %w", err)
-	}
-
-	size := len(hashablePart) + io.GetVarSize(len(tx.Signers))
-	ef := l.bc.GetBaseExecFee()
-
-	var netFee int64
-	for i, signer := range tx.Signers {
-		var verificationScript []byte
-		for _, w := range tx.Scripts {
-			if w.VerificationScript != nil && hash.Hash160(w.VerificationScript).Equals(signer.Account) {
-				verificationScript = w.VerificationScript
-				break
-			}
-		}
-		if verificationScript == nil {
-			gasConsumed, err := l.bc.VerifyWitness(signer.Account, tx, &tx.Scripts[i], l.maxGasInvoke)
-			if err != nil {
-				return 0, fmt.Errorf("invalid signature: %w", err)
-			}
-			netFee += gasConsumed
-			size += io.GetVarSize([]byte{}) + io.GetVarSize(tx.Scripts[i].InvocationScript)
-			continue
-		}
-
-		fee, sizeDelta := fee.Calculate(ef, verificationScript)
-		netFee += fee
-		size += sizeDelta
-	}
-
-	fee := l.bc.FeePerByte()
-	netFee += int64(size) * fee
-
-	return netFee, nil
-}
-
-// AddNetworkFee adds network fee for each witness script and optional extra
-// network fee to transaction. `accs` is an array signer's accounts.
-// Copied from neo-go with minor corrections (no need to support contract signers):
-// https://github.com/nspcc-dev/neo-go/blob/6ff11baa1b9e4c71ef0d1de43b92a8c541ca732c/pkg/rpc/client/rpc.go#L960
-func (l *localClient) AddNetworkFee(tx *transaction.Transaction, extraFee int64, accs ...*wallet.Account) error {
-	if len(tx.Signers) != len(accs) {
-		return errors.New("number of signers must match number of scripts")
-	}
-
-	size := io.GetVarSize(tx)
-	ef := l.bc.GetBaseExecFee()
-	for i := range tx.Signers {
-		netFee, sizeDelta := fee.Calculate(ef, accs[i].Contract.Script)
-		tx.NetworkFee += netFee
-		size += sizeDelta
-	}
-
-	tx.NetworkFee += int64(size)*l.bc.FeePerByte() + extraFee
-	return nil
-}
-
-// getSigners returns an array of transaction signers and corresponding accounts from
-// given sender and cosigners. If cosigners list already contains sender, the sender
-// will be placed at the start of the list.
-// Copied from neo-go with minor corrections:
-// https://github.com/nspcc-dev/neo-go/blob/6ff11baa1b9e4c71ef0d1de43b92a8c541ca732c/pkg/rpc/client/rpc.go#L735
-func getSigners(sender *wallet.Account, cosigners []rpcclient.SignerAccount) ([]transaction.Signer, []*wallet.Account, error) {
-	var (
-		signers  []transaction.Signer
-		accounts []*wallet.Account
-	)
-
-	from := sender.Contract.ScriptHash()
-	s := transaction.Signer{
-		Account: from,
-		Scopes:  transaction.None,
-	}
-	for _, c := range cosigners {
-		if c.Signer.Account == from {
-			s = c.Signer
-			continue
-		}
-		signers = append(signers, c.Signer)
-		accounts = append(accounts, c.Account)
-	}
-	signers = append([]transaction.Signer{s}, signers...)
-	accounts = append([]*wallet.Account{sender}, accounts...)
-	return signers, accounts, nil
-}
-
-func (l *localClient) NEP17BalanceOf(h util.Uint160, acc util.Uint160) (int64, error) {
-	res, err := invokeFunction(l, h, "balanceOf", []any{acc}, nil)
+	// Avoid setting hash for this tx: server code doesn't touch client transaction.
+	data := tx.Bytes()
+	tx, err := transaction.NewTransactionFromBytes(data)
 	if err != nil {
 		return 0, err
 	}
-	if res.State != vmstate.Halt.String() || len(res.Stack) == 0 {
-		return 0, fmt.Errorf("`balance`: invalid response (empty: %t): %s",
-			len(res.Stack) == 0, res.FaultException)
+
+	hashablePart, err := tx.EncodeHashableFields()
+	if err != nil {
+		return 0, err
 	}
-	bi, err := res.Stack[0].TryInteger()
-	if err != nil || !bi.IsInt64() {
-		return 0, fmt.Errorf("`balance`: invalid response")
+	size := len(hashablePart) + io.GetVarSize(len(tx.Signers))
+	var (
+		netFee int64
+		// Verification GAS cost can't exceed this policy.
+		gasLimit = l.bc.GetMaxVerificationGAS()
+	)
+	for i, signer := range tx.Signers {
+		w := tx.Scripts[i]
+		if len(w.InvocationScript) == 0 { // No invocation provided, try to infer one.
+			var paramz []manifest.Parameter
+			if len(w.VerificationScript) == 0 { // Contract-based verification
+				cs := l.bc.GetContractState(signer.Account)
+				if cs == nil {
+					return 0, fmt.Errorf("signer %d has no verification script and no deployed contract", i)
+				}
+				md := cs.Manifest.ABI.GetMethod(manifest.MethodVerify, -1)
+				if md == nil || md.ReturnType != smartcontract.BoolType {
+					return 0, fmt.Errorf("signer %d has no verify method in deployed contract", i)
+				}
+				paramz = md.Parameters // Might as well have none params and it's OK.
+			} else { // Regular signature verification.
+				if vm.IsSignatureContract(w.VerificationScript) {
+					paramz = []manifest.Parameter{{Type: smartcontract.SignatureType}}
+				} else if nSigs, _, ok := vm.ParseMultiSigContract(w.VerificationScript); ok {
+					paramz = make([]manifest.Parameter, nSigs)
+					for j := 0; j < nSigs; j++ {
+						paramz[j] = manifest.Parameter{Type: smartcontract.SignatureType}
+					}
+				}
+			}
+			inv := io.NewBufBinWriter()
+			for _, p := range paramz {
+				p.Type.EncodeDefaultValue(inv.BinWriter)
+			}
+			if inv.Err != nil {
+				return 0, fmt.Errorf("failed to create dummy invocation script (signer %d): %s", i, inv.Err.Error())
+			}
+			w.InvocationScript = inv.Bytes()
+		}
+		gasConsumed, err := l.bc.VerifyWitness(signer.Account, tx, &w, gasLimit)
+		if err != nil && !errors.Is(err, core.ErrInvalidSignature) {
+			return 0, err
+		}
+		gasLimit -= gasConsumed
+		netFee += gasConsumed
+		size += io.GetVarSize(w.VerificationScript) + io.GetVarSize(w.InvocationScript)
 	}
-	return bi.Int64(), nil
+	if l.bc.P2PSigExtensionsEnabled() {
+		attrs := tx.GetAttributes(transaction.NotaryAssistedT)
+		if len(attrs) != 0 {
+			na := attrs[0].Value.(*transaction.NotaryAssisted)
+			netFee += (int64(na.NKeys) + 1) * l.bc.GetNotaryServiceFeePerKey()
+		}
+	}
+	fee := l.bc.FeePerByte()
+	netFee += int64(size) * fee
+	return netFee, nil
 }
 
 func (l *localClient) InvokeScript(script []byte, signers []transaction.Signer) (*result.Invoke, error) {

cmd/frostfs-adm/internal/modules/morph/n3client.go

@@ -6,13 +6,10 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/nspcc-dev/neo-go/pkg/config/netmode"
 	"github.com/nspcc-dev/neo-go/pkg/core/state"
 	"github.com/nspcc-dev/neo-go/pkg/core/transaction"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
-	"github.com/nspcc-dev/neo-go/pkg/encoding/fixedn"
 	"github.com/nspcc-dev/neo-go/pkg/neorpc/result"
-	"github.com/nspcc-dev/neo-go/pkg/network/payload"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
@@ -29,21 +26,12 @@ type Client interface {
 	invoker.RPCInvoke
 
 	GetBlockCount() (uint32, error)
-	GetContractStateByID(int32) (*state.Contract, error)
-	GetContractStateByHash(util.Uint160) (*state.Contract, error)
 	GetNativeContracts() ([]state.NativeContract, error)
-	GetNetwork() (netmode.Magic, error)
 	GetApplicationLog(util.Uint256, *trigger.Type) (*result.ApplicationLog, error)
 	GetVersion() (*result.Version, error)
-	CreateTxFromScript([]byte, *wallet.Account, int64, int64, []rpcclient.SignerAccount) (*transaction.Transaction, error)
-	NEP17BalanceOf(util.Uint160, util.Uint160) (int64, error)
 	SendRawTransaction(*transaction.Transaction) (util.Uint256, error)
 	GetCommittee() (keys.PublicKeys, error)
-	CalculateNotaryFee(uint8) (int64, error)
 	CalculateNetworkFee(tx *transaction.Transaction) (int64, error)
-	AddNetworkFee(*transaction.Transaction, int64, ...*wallet.Account) error
-	SignAndPushInvocationTx([]byte, *wallet.Account, int64, fixedn.Fixed8, []rpcclient.SignerAccount) (util.Uint256, error)
-	SignAndPushP2PNotaryRequest(*transaction.Transaction, []byte, int64, int64, uint32, *wallet.Account) (*payload.P2PNotaryRequest, error)
 }
 
 type hashVUBPair struct {

cmd/frostfs-adm/internal/modules/morph/netmap_candidates.go

@@ -5,6 +5,7 @@ import (
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/client/netmap"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -14,8 +15,9 @@ func listNetmapCandidatesNodes(cmd *cobra.Command, _ []string) {
 	commonCmd.ExitOnErr(cmd, "can't create N3 client: %w", err)
 
 	inv := invoker.New(c, nil)
+	r := management.NewReader(inv)
 
-	cs, err := c.GetContractStateByID(1)
+	cs, err := r.GetContractByID(1)
 	commonCmd.ExitOnErr(cmd, "can't get NNS contract info: %w", err)
 
 	nmHash, err := nnsResolveHash(inv, cs.Hash, netmapContract+".frostfs")

cmd/frostfs-adm/internal/modules/morph/netmap_util.go

@@ -0,0 +1,44 @@
+package morph
+
+import (
+	"errors"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/morph/client/netmap"
+	"github.com/nspcc-dev/neo-go/pkg/vm/stackitem"
+	"github.com/spf13/viper"
+)
+
+func getDefaultNetmapContractConfigMap() map[string]any {
+	m := make(map[string]any)
+	m[netmap.EpochDurationConfig] = viper.GetInt64(epochDurationInitFlag)
+	m[netmap.MaxObjectSizeConfig] = viper.GetInt64(maxObjectSizeInitFlag)
+	m[netmap.ContainerFeeConfig] = viper.GetInt64(containerFeeInitFlag)
+	m[netmap.ContainerAliasFeeConfig] = viper.GetInt64(containerAliasFeeInitFlag)
+	m[netmap.IrCandidateFeeConfig] = viper.GetInt64(candidateFeeInitFlag)
+	m[netmap.WithdrawFeeConfig] = viper.GetInt64(withdrawFeeInitFlag)
+	m[netmap.HomomorphicHashingDisabledKey] = viper.GetBool(homomorphicHashDisabledInitFlag)
+	m[netmap.MaintenanceModeAllowedConfig] = viper.GetBool(maintenanceModeAllowedInitFlag)
+	return m
+}
+
+func parseConfigFromNetmapContract(arr []stackitem.Item) (map[string][]byte, error) {
+	m := make(map[string][]byte, len(arr))
+	for _, param := range arr {
+		tuple, ok := param.Value().([]stackitem.Item)
+		if !ok || len(tuple) != 2 {
+			return nil, errors.New("invalid ListConfig response from netmap contract")
+		}
+
+		k, err := tuple[0].TryBytes()
+		if err != nil {
+			return nil, errors.New("invalid config key from netmap contract")
+		}
+
+		v, err := tuple[1].TryBytes()
+		if err != nil {
+			return nil, invalidConfigValueErr(string(k))
+		}
+		m[string(k)] = v
+	}
+	return m, nil
+}

cmd/frostfs-adm/internal/modules/morph/policy.go

@@ -1,11 +1,15 @@
 package morph
 
 import (
+	"bytes"
 	"fmt"
 	"strconv"
 	"strings"
+	"text/tabwriter"
 
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
 	"github.com/nspcc-dev/neo-go/pkg/io"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/policy"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/vm/emit"
@@ -52,3 +56,32 @@ func setPolicyCmd(cmd *cobra.Command, args []string) error {
 
 	return wCtx.awaitTx()
 }
+
+func dumpPolicyCmd(cmd *cobra.Command, _ []string) error {
+	c, err := getN3Client(viper.GetViper())
+	commonCmd.ExitOnErr(cmd, "can't create N3 client:", err)
+
+	inv := invoker.New(c, nil)
+	policyContract := policy.NewReader(inv)
+
+	execFee, err := policyContract.GetExecFeeFactor()
+	commonCmd.ExitOnErr(cmd, "can't get execution fee factor:", err)
+
+	feePerByte, err := policyContract.GetFeePerByte()
+	commonCmd.ExitOnErr(cmd, "can't get fee per byte:", err)
+
+	storagePrice, err := policyContract.GetStoragePrice()
+	commonCmd.ExitOnErr(cmd, "can't get storage price:", err)
+
+	buf := bytes.NewBuffer(nil)
+	tw := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
+
+	_, _ = tw.Write([]byte(fmt.Sprintf("Execution Fee Factor:\t%d (int)\n", execFee)))
+	_, _ = tw.Write([]byte(fmt.Sprintf("Fee Per Byte:\t%d (int)\n", feePerByte)))
+	_, _ = tw.Write([]byte(fmt.Sprintf("Storage Price:\t%d (int)\n", storagePrice)))
+
+	_ = tw.Flush()
+	cmd.Print(buf.String())
+
+	return nil
+}

cmd/frostfs-adm/internal/modules/morph/remove_node.go

@@ -7,6 +7,7 @@ import (
 	netmapcontract "git.frostfs.info/TrueCloudLab/frostfs-contract/netmap"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"github.com/nspcc-dev/neo-go/pkg/io"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/management"
 	"github.com/nspcc-dev/neo-go/pkg/smartcontract/callflag"
 	"github.com/nspcc-dev/neo-go/pkg/vm/emit"
 	"github.com/spf13/cobra"
@@ -33,7 +34,8 @@ func removeNodesCmd(cmd *cobra.Command, args []string) error {
 	}
 	defer wCtx.close()
 
-	cs, err := wCtx.Client.GetContractStateByID(1)
+	r := management.NewReader(wCtx.ReadOnlyInvoker)
+	cs, err := r.GetContractByID(1)
 	if err != nil {
 		return fmt.Errorf("can't get NNS contract info: %w", err)
 	}

cmd/frostfs-adm/internal/modules/morph/root.go

@@ -18,10 +18,6 @@ const (
 	maxObjectSizeCLIFlag            = "max-object-size"
 	epochDurationInitFlag           = "network.epoch_duration"
 	epochDurationCLIFlag            = "epoch-duration"
-	incomeRateInitFlag              = "network.basic_income_rate"
-	incomeRateCLIFlag               = "basic-income-rate"
-	auditFeeInitFlag                = "network.fee.audit"
-	auditFeeCLIFlag                 = "audit-fee"
 	containerFeeInitFlag            = "network.fee.container"
 	containerAliasFeeInitFlag       = "network.fee.container_alias"
 	containerFeeCLIFlag             = "container-fee"
@@ -69,15 +65,12 @@ var (
 			_ = viper.BindPFlag(endpointFlag, cmd.Flags().Lookup(endpointFlag))
 			_ = viper.BindPFlag(epochDurationInitFlag, cmd.Flags().Lookup(epochDurationCLIFlag))
 			_ = viper.BindPFlag(maxObjectSizeInitFlag, cmd.Flags().Lookup(maxObjectSizeCLIFlag))
-			_ = viper.BindPFlag(incomeRateInitFlag, cmd.Flags().Lookup(incomeRateCLIFlag))
 			_ = viper.BindPFlag(homomorphicHashDisabledInitFlag, cmd.Flags().Lookup(homomorphicHashDisabledCLIFlag))
-			_ = viper.BindPFlag(auditFeeInitFlag, cmd.Flags().Lookup(auditFeeCLIFlag))
 			_ = viper.BindPFlag(candidateFeeInitFlag, cmd.Flags().Lookup(candidateFeeCLIFlag))
 			_ = viper.BindPFlag(containerFeeInitFlag, cmd.Flags().Lookup(containerFeeCLIFlag))
 			_ = viper.BindPFlag(containerAliasFeeInitFlag, cmd.Flags().Lookup(containerAliasFeeCLIFlag))
 			_ = viper.BindPFlag(withdrawFeeInitFlag, cmd.Flags().Lookup(withdrawFeeCLIFlag))
 			_ = viper.BindPFlag(protoConfigPath, cmd.Flags().Lookup(protoConfigPath))
-			_ = viper.BindPFlag(localDumpFlag, cmd.Flags().Lookup(localDumpFlag))
 		},
 		RunE: initializeSideChainCmd,
 	}
@@ -153,6 +146,15 @@ var (
 		},
 	}
 
+	dumpPolicy = &cobra.Command{
+		Use:   "dump-policy",
+		Short: "Dump FrostFS policy",
+		PreRun: func(cmd *cobra.Command, _ []string) {
+			_ = viper.BindPFlag(endpointFlag, cmd.Flags().Lookup(endpointFlag))
+		},
+		RunE: dumpPolicyCmd,
+	}
+
 	dumpContractHashesCmd = &cobra.Command{
 		Use:   "dump-hashes",
 		Short: "Dump deployed contract hashes",
@@ -246,6 +248,7 @@ func init() {
 	initForceNewEpochCmd()
 	initRemoveNodesCmd()
 	initSetPolicyCmd()
+	initDumpPolicyCmd()
 	initDumpContractHashesCmd()
 	initDumpNetworkConfigCmd()
 	initSetConfigCmd()
@@ -255,7 +258,6 @@ func init() {
 	initRestoreContainersCmd()
 	initListContainersCmd()
 	initRefillGasCmd()
-	initSubnetCmd()
 	initDepositoryNotaryCmd()
 	initNetmapCandidatesCmd()
 }
@@ -274,10 +276,6 @@ func initDepositoryNotaryCmd() {
 	depositNotaryCmd.Flags().String(notaryDepositTillFlag, "", "Notary deposit duration in blocks")
 }
 
-func initSubnetCmd() {
-	RootCmd.AddCommand(cmdSubnet)
-}
-
 func initRefillGasCmd() {
 	RootCmd.AddCommand(refillGasCmd)
 	refillGasCmd.Flags().String(alphabetWalletsFlag, "", "Path to alphabet wallets dir")
@@ -314,7 +312,8 @@ func initUpdateContractsCmd() {
 	RootCmd.AddCommand(updateContractsCmd)
 	updateContractsCmd.Flags().String(alphabetWalletsFlag, "", "Path to alphabet wallets dir")
 	updateContractsCmd.Flags().StringP(endpointFlag, "r", "", "N3 RPC node endpoint")
-	updateContractsCmd.Flags().String(contractsInitFlag, "", "Path to archive with compiled FrostFS contracts (default fetched from latest github release)")
+	updateContractsCmd.Flags().String(contractsInitFlag, "", "Path to archive with compiled FrostFS contracts")
+	_ = updateContractsCmd.MarkFlagRequired(contractsInitFlag)
 }
 
 func initDumpBalancesCmd() {
@@ -331,6 +330,7 @@ func initSetConfigCmd() {
 	setConfig.Flags().String(alphabetWalletsFlag, "", "Path to alphabet wallets dir")
 	setConfig.Flags().StringP(endpointFlag, "r", "", "N3 RPC node endpoint")
 	setConfig.Flags().Bool(forceConfigSet, false, "Force setting not well-known configuration key")
+	setConfig.Flags().String(localDumpFlag, "", "Path to the blocks dump file")
 }
 
 func initDumpNetworkConfigCmd() {
@@ -348,18 +348,26 @@ func initSetPolicyCmd() {
 	RootCmd.AddCommand(setPolicy)
 	setPolicy.Flags().String(alphabetWalletsFlag, "", "Path to alphabet wallets dir")
 	setPolicy.Flags().StringP(endpointFlag, "r", "", "N3 RPC node endpoint")
+	setPolicy.Flags().String(localDumpFlag, "", "Path to the blocks dump file")
+}
+
+func initDumpPolicyCmd() {
+	RootCmd.AddCommand(dumpPolicy)
+	dumpPolicy.Flags().StringP(endpointFlag, "r", "", "N3 RPC node endpoint")
 }
 
 func initRemoveNodesCmd() {
 	RootCmd.AddCommand(removeNodes)
 	removeNodes.Flags().String(alphabetWalletsFlag, "", "Path to alphabet wallets dir")
 	removeNodes.Flags().StringP(endpointFlag, "r", "", "N3 RPC node endpoint")
+	removeNodes.Flags().String(localDumpFlag, "", "Path to the blocks dump file")
 }
 
 func initForceNewEpochCmd() {
 	RootCmd.AddCommand(forceNewEpoch)
 	forceNewEpoch.Flags().String(alphabetWalletsFlag, "", "Path to alphabet wallets dir")
 	forceNewEpoch.Flags().StringP(endpointFlag, "r", "", "N3 RPC node endpoint")
+	forceNewEpoch.Flags().String(localDumpFlag, "", "Path to the blocks dump file")
 }
 
 func initGenerateStorageCmd() {
@@ -375,7 +383,8 @@ func initInitCmd() {
 	RootCmd.AddCommand(initCmd)
 	initCmd.Flags().String(alphabetWalletsFlag, "", "Path to alphabet wallets dir")
 	initCmd.Flags().StringP(endpointFlag, "r", "", "N3 RPC node endpoint")
-	initCmd.Flags().String(contractsInitFlag, "", "Path to archive with compiled FrostFS contracts (default fetched from latest github release)")
+	initCmd.Flags().String(contractsInitFlag, "", "Path to archive with compiled FrostFS contracts")
+	_ = initCmd.MarkFlagRequired(contractsInitFlag)
 	initCmd.Flags().Uint(epochDurationCLIFlag, 240, "Amount of side chain blocks in one FrostFS epoch")
 	initCmd.Flags().Uint(maxObjectSizeCLIFlag, 67108864, "Max single object size in bytes")
 	initCmd.Flags().Bool(homomorphicHashDisabledCLIFlag, false, "Disable object homomorphic hashing")

cmd/frostfs-adm/internal/modules/root.go

@@ -15,16 +15,14 @@ import (
 	"github.com/spf13/viper"
 )
 
-var (
-	rootCmd = &cobra.Command{
-		Use:   "frostfs-adm",
-		Short: "FrostFS Administrative Tool",
-		Long: `FrostFS Administrative Tool provides functions to setup and
+var rootCmd = &cobra.Command{
+	Use:   "frostfs-adm",
+	Short: "FrostFS Administrative Tool",
+	Long: `FrostFS Administrative Tool provides functions to setup and
 manage FrostFS network deployment.`,
-		RunE:         entryPoint,
-		SilenceUsage: true,
-	}
-)
+	RunE:         entryPoint,
+	SilenceUsage: true,
+}
 
 func init() {
 	cobra.OnInitialize(func() { initConfig(rootCmd) })
@@ -45,14 +43,14 @@ func init() {
 	rootCmd.AddCommand(storagecfg.RootCmd)
 
 	rootCmd.AddCommand(autocomplete.Command("frostfs-adm"))
-	rootCmd.AddCommand(gendoc.Command(rootCmd))
+	rootCmd.AddCommand(gendoc.Command(rootCmd, gendoc.Options{}))
 }
 
 func Execute() error {
 	return rootCmd.Execute()
 }
 
-func entryPoint(cmd *cobra.Command, args []string) error {
+func entryPoint(cmd *cobra.Command, _ []string) error {
 	printVersion, _ := cmd.Flags().GetBool("version")
 	if printVersion {
 		cmd.Print(misc.BuildInfo("FrostFS Adm"))

cmd/frostfs-adm/internal/modules/storagecfg/config.go

@@ -12,9 +12,6 @@ node:
     - {{ .AnnouncedAddress }}
   attribute_0: UN-LOCODE:{{ .Attribute.Locode }}
   relay: {{ .Relay }}  # start Storage node in relay mode without bootstrapping into the Network map
-  subnet:
-    exit_zero: false # toggle entrance to zero subnet (overrides corresponding attribute and occurrence in entries)
-    entries: [] # list of IDs of subnets to enter in a text format of FrostFS API protocol (overrides corresponding attributes)
 
 grpc:
   num: 1  # total number of listener endpoints

cmd/frostfs-adm/internal/modules/storagecfg/root.go

@@ -145,7 +145,7 @@ func storageConfig(cmd *cobra.Command, args []string) {
 	}
 
 	out := applyTemplate(c)
-	fatalOnErr(os.WriteFile(outPath, out, 0644))
+	fatalOnErr(os.WriteFile(outPath, out, 0o644))
 
 	cmd.Println("Node is ready for work! Run `frostfs-node -config " + outPath + "`")
 }

cmd/frostfs-cli/docs/storage-node-xheaders.md

@@ -26,7 +26,6 @@ If set to '0' or not set, only the current epoch is used.
 List of commands with support of extended headers:
 * `container list-objects`
 * `object delete/get/hash/head/lock/put/range/search`
-* `storagegroup delete/get/list/put`
 
 Example:
 ```shell

cmd/frostfs-cli/internal/client/client.go

@@ -6,14 +6,17 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"sort"
+	"strings"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/accounting"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/checksum"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	containerSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/eacl"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
+	objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/version"
 )
@@ -37,8 +40,8 @@ func (x BalanceOfRes) Balance() accounting.Decimal {
 // BalanceOf requests the current balance of a FrostFS user.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func BalanceOf(prm BalanceOfPrm) (res BalanceOfRes, err error) {
-	res.cliRes, err = prm.cli.BalanceGet(context.Background(), prm.PrmBalanceGet)
+func BalanceOf(ctx context.Context, prm BalanceOfPrm) (res BalanceOfRes, err error) {
+	res.cliRes, err = prm.cli.BalanceGet(ctx, prm.PrmBalanceGet)
 
 	return
 }
@@ -62,16 +65,26 @@ func (x ListContainersRes) IDList() []cid.ID {
 // ListContainers requests a list of FrostFS user's containers.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func ListContainers(prm ListContainersPrm) (res ListContainersRes, err error) {
-	res.cliRes, err = prm.cli.ContainerList(context.Background(), prm.PrmContainerList)
+func ListContainers(ctx context.Context, prm ListContainersPrm) (res ListContainersRes, err error) {
+	res.cliRes, err = prm.cli.ContainerList(ctx, prm.PrmContainerList)
 
 	return
 }
 
+// SortedIDList returns sorted list of identifiers of user's containers.
+func (x ListContainersRes) SortedIDList() []cid.ID {
+	list := x.cliRes.Containers()
+	sort.Slice(list, func(i, j int) bool {
+		lhs, rhs := list[i].EncodeToString(), list[j].EncodeToString()
+		return strings.Compare(lhs, rhs) < 0
+	})
+	return list
+}
+
 // PutContainerPrm groups parameters of PutContainer operation.
 type PutContainerPrm struct {
-	commonPrm
-	client.PrmContainerPut
+	Client       *client.Client
+	ClientParams client.PrmContainerPut
 }
 
 // PutContainerRes groups the resulting values of PutContainer operation.
@@ -92,8 +105,8 @@ func (x PutContainerRes) ID() cid.ID {
 // Success can be verified by reading by identifier.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func PutContainer(prm PutContainerPrm) (res PutContainerRes, err error) {
-	cliRes, err := prm.cli.ContainerPut(context.Background(), prm.PrmContainerPut)
+func PutContainer(ctx context.Context, prm PutContainerPrm) (res PutContainerRes, err error) {
+	cliRes, err := prm.Client.ContainerPut(ctx, prm.ClientParams)
 	if err == nil {
 		res.cnr = cliRes.ID()
 	}
@@ -103,13 +116,15 @@ func PutContainer(prm PutContainerPrm) (res PutContainerRes, err error) {
 
 // GetContainerPrm groups parameters of GetContainer operation.
 type GetContainerPrm struct {
-	commonPrm
-	cliPrm client.PrmContainerGet
+	Client       *client.Client
+	ClientParams client.PrmContainerGet
 }
 
 // SetContainer sets identifier of the container to be read.
+//
+// Deprecated: Use GetContainerPrm.ClientParams.ContainerID instead.
 func (x *GetContainerPrm) SetContainer(id cid.ID) {
-	x.cliPrm.SetContainer(id)
+	x.ClientParams.ContainerID = &id
 }
 
 // GetContainerRes groups the resulting values of GetContainer operation.
@@ -125,20 +140,23 @@ func (x GetContainerRes) Container() containerSDK.Container {
 // GetContainer reads a container from FrostFS by ID.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func GetContainer(prm GetContainerPrm) (res GetContainerRes, err error) {
-	res.cliRes, err = prm.cli.ContainerGet(context.Background(), prm.cliPrm)
+func GetContainer(ctx context.Context, prm GetContainerPrm) (res GetContainerRes, err error) {
+	res.cliRes, err = prm.Client.ContainerGet(ctx, prm.ClientParams)
 
 	return
 }
 
 // IsACLExtendable checks if ACL of the container referenced by the given identifier
 // can be extended. Client connection MUST BE correctly established in advance.
-func IsACLExtendable(c *client.Client, cnr cid.ID) (bool, error) {
-	var prm GetContainerPrm
-	prm.SetClient(c)
-	prm.SetContainer(cnr)
+func IsACLExtendable(ctx context.Context, c *client.Client, cnr cid.ID) (bool, error) {
+	prm := GetContainerPrm{
+		Client: c,
+		ClientParams: client.PrmContainerGet{
+			ContainerID: &cnr,
+		},
+	}
 
-	res, err := GetContainer(prm)
+	res, err := GetContainer(ctx, prm)
 	if err != nil {
 		return false, fmt.Errorf("get container from the FrostFS: %w", err)
 	}
@@ -148,8 +166,8 @@ func IsACLExtendable(c *client.Client, cnr cid.ID) (bool, error) {
 
 // DeleteContainerPrm groups parameters of DeleteContainerPrm operation.
 type DeleteContainerPrm struct {
-	commonPrm
-	client.PrmContainerDelete
+	Client       *client.Client
+	ClientParams client.PrmContainerDelete
 }
 
 // DeleteContainerRes groups the resulting values of DeleteContainer operation.
@@ -163,16 +181,16 @@ type DeleteContainerRes struct{}
 // Success can be verified by reading by identifier.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func DeleteContainer(prm DeleteContainerPrm) (res DeleteContainerRes, err error) {
-	_, err = prm.cli.ContainerDelete(context.Background(), prm.PrmContainerDelete)
+func DeleteContainer(ctx context.Context, prm DeleteContainerPrm) (res DeleteContainerRes, err error) {
+	_, err = prm.Client.ContainerDelete(ctx, prm.ClientParams)
 
 	return
 }
 
 // EACLPrm groups parameters of EACL operation.
 type EACLPrm struct {
-	commonPrm
-	client.PrmContainerEACL
+	Client       *client.Client
+	ClientParams client.PrmContainerEACL
 }
 
 // EACLRes groups the resulting values of EACL operation.
@@ -188,16 +206,16 @@ func (x EACLRes) EACL() eacl.Table {
 // EACL reads eACL table from FrostFS by container ID.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func EACL(prm EACLPrm) (res EACLRes, err error) {
-	res.cliRes, err = prm.cli.ContainerEACL(context.Background(), prm.PrmContainerEACL)
+func EACL(ctx context.Context, prm EACLPrm) (res EACLRes, err error) {
+	res.cliRes, err = prm.Client.ContainerEACL(ctx, prm.ClientParams)
 
 	return
 }
 
 // SetEACLPrm groups parameters of SetEACL operation.
 type SetEACLPrm struct {
-	commonPrm
-	client.PrmContainerSetEACL
+	Client       *client.Client
+	ClientParams client.PrmContainerSetEACL
 }
 
 // SetEACLRes groups the resulting values of SetEACL operation.
@@ -211,16 +229,16 @@ type SetEACLRes struct{}
 // Success can be verified by reading by container identifier.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func SetEACL(prm SetEACLPrm) (res SetEACLRes, err error) {
-	_, err = prm.cli.ContainerSetEACL(context.Background(), prm.PrmContainerSetEACL)
+func SetEACL(ctx context.Context, prm SetEACLPrm) (res SetEACLRes, err error) {
+	_, err = prm.Client.ContainerSetEACL(ctx, prm.ClientParams)
 
 	return
 }
 
 // NetworkInfoPrm groups parameters of NetworkInfo operation.
 type NetworkInfoPrm struct {
-	commonPrm
-	client.PrmNetworkInfo
+	Client       *client.Client
+	ClientParams client.PrmNetworkInfo
 }
 
 // NetworkInfoRes groups the resulting values of NetworkInfo operation.
@@ -236,16 +254,16 @@ func (x NetworkInfoRes) NetworkInfo() netmap.NetworkInfo {
 // NetworkInfo reads information about the FrostFS network.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func NetworkInfo(prm NetworkInfoPrm) (res NetworkInfoRes, err error) {
-	res.cliRes, err = prm.cli.NetworkInfo(context.Background(), prm.PrmNetworkInfo)
+func NetworkInfo(ctx context.Context, prm NetworkInfoPrm) (res NetworkInfoRes, err error) {
+	res.cliRes, err = prm.Client.NetworkInfo(ctx, prm.ClientParams)
 
 	return
 }
 
 // NodeInfoPrm groups parameters of NodeInfo operation.
 type NodeInfoPrm struct {
-	commonPrm
-	client.PrmEndpointInfo
+	Client       *client.Client
+	ClientParams client.PrmEndpointInfo
 }
 
 // NodeInfoRes groups the resulting values of NodeInfo operation.
@@ -266,8 +284,8 @@ func (x NodeInfoRes) LatestVersion() version.Version {
 // NodeInfo requests information about the remote server from FrostFS netmap.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func NodeInfo(prm NodeInfoPrm) (res NodeInfoRes, err error) {
-	res.cliRes, err = prm.cli.EndpointInfo(context.Background(), prm.PrmEndpointInfo)
+func NodeInfo(ctx context.Context, prm NodeInfoPrm) (res NodeInfoRes, err error) {
+	res.cliRes, err = prm.Client.EndpointInfo(ctx, prm.ClientParams)
 
 	return
 }
@@ -290,8 +308,8 @@ func (x NetMapSnapshotRes) NetMap() netmap.NetMap {
 // NetMapSnapshot requests current network view of the remote server.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func NetMapSnapshot(prm NetMapSnapshotPrm) (res NetMapSnapshotRes, err error) {
-	res.cliRes, err = prm.cli.NetMapSnapshot(context.Background(), client.PrmNetMapSnapshot{})
+func NetMapSnapshot(ctx context.Context, prm NetMapSnapshotPrm) (res NetMapSnapshotRes, err error) {
+	res.cliRes, err = prm.cli.NetMapSnapshot(ctx, client.PrmNetMapSnapshot{})
 	return
 }
 
@@ -319,8 +337,8 @@ func (x CreateSessionRes) SessionKey() []byte {
 // CreateSession opens a new unlimited session with the remote node.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func CreateSession(prm CreateSessionPrm) (res CreateSessionRes, err error) {
-	res.cliRes, err = prm.cli.SessionCreate(context.Background(), prm.PrmSessionCreate)
+func CreateSession(ctx context.Context, prm CreateSessionPrm) (res CreateSessionRes, err error) {
+	res.cliRes, err = prm.cli.SessionCreate(ctx, prm.PrmSessionCreate)
 
 	return
 }
@@ -329,15 +347,19 @@ func CreateSession(prm CreateSessionPrm) (res CreateSessionRes, err error) {
 type PutObjectPrm struct {
 	commonObjectPrm
 
-	hdr *object.Object
+	copyNum []uint32
+
+	hdr *objectSDK.Object
 
 	rdr io.Reader
 
-	headerCallback func(*object.Object)
+	headerCallback func(*objectSDK.Object)
+
+	prepareLocally bool
 }
 
 // SetHeader sets object header.
-func (x *PutObjectPrm) SetHeader(hdr *object.Object) {
+func (x *PutObjectPrm) SetHeader(hdr *objectSDK.Object) {
 	x.hdr = hdr
 }
 
@@ -348,10 +370,44 @@ func (x *PutObjectPrm) SetPayloadReader(rdr io.Reader) {
 
 // SetHeaderCallback sets callback which is called on the object after the header is received
 // but before the payload is written.
-func (x *PutObjectPrm) SetHeaderCallback(f func(*object.Object)) {
+func (x *PutObjectPrm) SetHeaderCallback(f func(*objectSDK.Object)) {
 	x.headerCallback = f
 }
 
+// SetCopiesNumberByVectors sets ordered list of minimal required object copies numbers
+// per placement vector.
+func (x *PutObjectPrm) SetCopiesNumberByVectors(copiesNumbers []uint32) {
+	x.copyNum = copiesNumbers
+}
+
+// PrepareLocally generate object header on the client side.
+// For big object - split locally too.
+func (x *PutObjectPrm) PrepareLocally() {
+	x.prepareLocally = true
+}
+
+func (x *PutObjectPrm) convertToSDKPrm(ctx context.Context) (client.PrmObjectPutInit, error) {
+	putPrm := client.PrmObjectPutInit{
+		XHeaders:     x.xHeaders,
+		BearerToken:  x.bearerToken,
+		Local:        x.local,
+		CopiesNumber: x.copyNum,
+	}
+
+	if x.prepareLocally {
+		res, err := x.cli.NetworkInfo(ctx, client.PrmNetworkInfo{})
+		if err != nil {
+			return client.PrmObjectPutInit{}, err
+		}
+		putPrm.MaxSize = res.Info().MaxObjectSize()
+		putPrm.EpochSource = epochSource(res.Info().CurrentEpoch())
+		putPrm.WithoutHomomorphHash = res.Info().HomomorphicHashingDisabled()
+	} else {
+		putPrm.Session = x.sessionToken
+	}
+	return putPrm, nil
+}
+
 // PutObjectRes groups the resulting values of PutObject operation.
 type PutObjectRes struct {
 	id oid.ID
@@ -362,32 +418,26 @@ func (x PutObjectRes) ID() oid.ID {
 	return x.id
 }
 
+type epochSource uint64
+
+func (s epochSource) CurrentEpoch() uint64 {
+	return uint64(s)
+}
+
 // PutObject saves the object in FrostFS network.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func PutObject(prm PutObjectPrm) (*PutObjectRes, error) {
-	var putPrm client.PrmObjectPutInit
-
-	if prm.sessionToken != nil {
-		putPrm.WithinSession(*prm.sessionToken)
+func PutObject(ctx context.Context, prm PutObjectPrm) (*PutObjectRes, error) {
+	sdkPrm, err := prm.convertToSDKPrm(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create parameters of object put operation: %w", err)
 	}
-
-	if prm.bearerToken != nil {
-		putPrm.WithBearerToken(*prm.bearerToken)
-	}
-
-	if prm.local {
-		putPrm.MarkLocal()
-	}
-
-	putPrm.WithXHeaders(prm.xHeaders...)
-
-	wrt, err := prm.cli.ObjectPutInit(context.Background(), putPrm)
+	wrt, err := prm.cli.ObjectPutInit(ctx, sdkPrm)
 	if err != nil {
 		return nil, fmt.Errorf("init object writing: %w", err)
 	}
 
-	if wrt.WriteHeader(*prm.hdr) {
+	if wrt.WriteHeader(ctx, *prm.hdr) {
 		if prm.headerCallback != nil {
 			prm.headerCallback(prm.hdr)
 		}
@@ -417,7 +467,7 @@ func PutObject(prm PutObjectPrm) (*PutObjectRes, error) {
 			for {
 				n, err = prm.rdr.Read(buf)
 				if n > 0 {
-					if !wrt.WritePayloadChunk(buf[:n]) {
+					if !wrt.WritePayloadChunk(ctx, buf[:n]) {
 						break
 					}
 
@@ -433,7 +483,7 @@ func PutObject(prm PutObjectPrm) (*PutObjectRes, error) {
 		}
 	}
 
-	cliRes, err := wrt.Close()
+	cliRes, err := wrt.Close(ctx)
 	if err != nil { // here err already carries both status and client errors
 		return nil, fmt.Errorf("client failure: %w", err)
 	}
@@ -462,22 +512,19 @@ func (x DeleteObjectRes) Tombstone() oid.ID {
 // DeleteObject marks an object to be removed from FrostFS through tombstone placement.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func DeleteObject(prm DeleteObjectPrm) (*DeleteObjectRes, error) {
-	var delPrm client.PrmObjectDelete
-	delPrm.FromContainer(prm.objAddr.Container())
-	delPrm.ByID(prm.objAddr.Object())
+func DeleteObject(ctx context.Context, prm DeleteObjectPrm) (*DeleteObjectRes, error) {
+	cnr := prm.objAddr.Container()
+	obj := prm.objAddr.Object()
 
-	if prm.sessionToken != nil {
-		delPrm.WithinSession(*prm.sessionToken)
+	delPrm := client.PrmObjectDelete{
+		XHeaders:    prm.xHeaders,
+		ContainerID: &cnr,
+		ObjectID:    &obj,
+		Session:     prm.sessionToken,
+		BearerToken: prm.bearerToken,
 	}
 
-	if prm.bearerToken != nil {
-		delPrm.WithBearerToken(*prm.bearerToken)
-	}
-
-	delPrm.WithXHeaders(prm.xHeaders...)
-
-	cliRes, err := prm.cli.ObjectDelete(context.Background(), delPrm)
+	cliRes, err := prm.cli.ObjectDelete(ctx, delPrm)
 	if err != nil {
 		return nil, fmt.Errorf("remove object via client: %w", err)
 	}
@@ -493,22 +540,22 @@ type GetObjectPrm struct {
 	objectAddressPrm
 	rawPrm
 	payloadWriterPrm
-	headerCallback func(*object.Object)
+	headerCallback func(*objectSDK.Object)
 }
 
 // SetHeaderCallback sets callback which is called on the object after the header is received
 // but before the payload is written.
-func (p *GetObjectPrm) SetHeaderCallback(f func(*object.Object)) {
+func (p *GetObjectPrm) SetHeaderCallback(f func(*objectSDK.Object)) {
 	p.headerCallback = f
 }
 
 // GetObjectRes groups the resulting values of GetObject operation.
 type GetObjectRes struct {
-	hdr *object.Object
+	hdr *objectSDK.Object
 }
 
 // Header returns the header of the request object.
-func (x GetObjectRes) Header() *object.Object {
+func (x GetObjectRes) Header() *objectSDK.Object {
 	return x.hdr
 }
 
@@ -518,35 +565,26 @@ func (x GetObjectRes) Header() *object.Object {
 //
 // Returns any error which prevented the operation from completing correctly in error return.
 // For raw reading, returns *object.SplitInfoError error if object is virtual.
-func GetObject(prm GetObjectPrm) (*GetObjectRes, error) {
-	var getPrm client.PrmObjectGet
-	getPrm.FromContainer(prm.objAddr.Container())
-	getPrm.ByID(prm.objAddr.Object())
+func GetObject(ctx context.Context, prm GetObjectPrm) (*GetObjectRes, error) {
+	cnr := prm.objAddr.Container()
+	obj := prm.objAddr.Object()
 
-	if prm.sessionToken != nil {
-		getPrm.WithinSession(*prm.sessionToken)
+	getPrm := client.PrmObjectGet{
+		XHeaders:    prm.xHeaders,
+		BearerToken: prm.bearerToken,
+		Session:     prm.sessionToken,
+		Raw:         prm.raw,
+		Local:       prm.local,
+		ContainerID: &cnr,
+		ObjectID:    &obj,
 	}
 
-	if prm.bearerToken != nil {
-		getPrm.WithBearerToken(*prm.bearerToken)
-	}
-
-	if prm.raw {
-		getPrm.MarkRaw()
-	}
-
-	if prm.local {
-		getPrm.MarkLocal()
-	}
-
-	getPrm.WithXHeaders(prm.xHeaders...)
-
-	rdr, err := prm.cli.ObjectGetInit(context.Background(), getPrm)
+	rdr, err := prm.cli.ObjectGetInit(ctx, getPrm)
 	if err != nil {
 		return nil, fmt.Errorf("init object reading on client: %w", err)
 	}
 
-	var hdr object.Object
+	var hdr objectSDK.Object
 
 	if !rdr.ReadHeader(&hdr) {
 		_, err = rdr.Close()
@@ -582,11 +620,11 @@ func (x *HeadObjectPrm) SetMainOnlyFlag(v bool) {
 
 // HeadObjectRes groups the resulting values of HeadObject operation.
 type HeadObjectRes struct {
-	hdr *object.Object
+	hdr *objectSDK.Object
 }
 
 // Header returns the requested object header.
-func (x HeadObjectRes) Header() *object.Object {
+func (x HeadObjectRes) Header() *objectSDK.Object {
 	return x.hdr
 }
 
@@ -594,35 +632,26 @@ func (x HeadObjectRes) Header() *object.Object {
 //
 // Returns any error which prevented the operation from completing correctly in error return.
 // For raw reading, returns *object.SplitInfoError error if object is virtual.
-func HeadObject(prm HeadObjectPrm) (*HeadObjectRes, error) {
-	var cliPrm client.PrmObjectHead
-	cliPrm.FromContainer(prm.objAddr.Container())
-	cliPrm.ByID(prm.objAddr.Object())
+func HeadObject(ctx context.Context, prm HeadObjectPrm) (*HeadObjectRes, error) {
+	cnr := prm.objAddr.Container()
+	obj := prm.objAddr.Object()
 
-	if prm.sessionToken != nil {
-		cliPrm.WithinSession(*prm.sessionToken)
+	headPrm := client.PrmObjectHead{
+		XHeaders:    prm.xHeaders,
+		BearerToken: prm.bearerToken,
+		Session:     prm.sessionToken,
+		Raw:         prm.raw,
+		Local:       prm.local,
+		ContainerID: &cnr,
+		ObjectID:    &obj,
 	}
 
-	if prm.bearerToken != nil {
-		cliPrm.WithBearerToken(*prm.bearerToken)
-	}
-
-	if prm.raw {
-		cliPrm.MarkRaw()
-	}
-
-	if prm.local {
-		cliPrm.MarkLocal()
-	}
-
-	cliPrm.WithXHeaders(prm.xHeaders...)
-
-	res, err := prm.cli.ObjectHead(context.Background(), cliPrm)
+	res, err := prm.cli.ObjectHead(ctx, headPrm)
 	if err != nil {
 		return nil, fmt.Errorf("read object header via client: %w", err)
 	}
 
-	var hdr object.Object
+	var hdr objectSDK.Object
 
 	if !res.ReadHeader(&hdr) {
 		return nil, fmt.Errorf("missing header in response")
@@ -638,11 +667,11 @@ type SearchObjectsPrm struct {
 	commonObjectPrm
 	containerIDPrm
 
-	filters object.SearchFilters
+	filters objectSDK.SearchFilters
 }
 
 // SetFilters sets search filters.
-func (x *SearchObjectsPrm) SetFilters(filters object.SearchFilters) {
+func (x *SearchObjectsPrm) SetFilters(filters objectSDK.SearchFilters) {
 	x.filters = filters
 }
 
@@ -659,26 +688,17 @@ func (x SearchObjectsRes) IDList() []oid.ID {
 // SearchObjects selects objects from the container which match the filters.
 //
 // Returns any error which prevented the operation from completing correctly in error return.
-func SearchObjects(prm SearchObjectsPrm) (*SearchObjectsRes, error) {
-	var cliPrm client.PrmObjectSearch
-	cliPrm.InContainer(prm.cnrID)
-	cliPrm.SetFilters(prm.filters)
-
-	if prm.sessionToken != nil {
-		cliPrm.WithinSession(*prm.sessionToken)
+func SearchObjects(ctx context.Context, prm SearchObjectsPrm) (*SearchObjectsRes, error) {
+	cliPrm := client.PrmObjectSearch{
+		XHeaders:    prm.xHeaders,
+		Local:       prm.local,
+		BearerToken: prm.bearerToken,
+		Session:     prm.sessionToken,
+		ContainerID: &prm.cnrID,
+		Filters:     prm.filters,
 	}
 
-	if prm.bearerToken != nil {
-		cliPrm.WithBearerToken(*prm.bearerToken)
-	}
-
-	if prm.local {
-		cliPrm.MarkLocal()
-	}
-
-	cliPrm.WithXHeaders(prm.xHeaders...)
-
-	rdr, err := prm.cli.ObjectSearchInit(context.Background(), cliPrm)
+	rdr, err := prm.cli.ObjectSearchInit(ctx, cliPrm)
 	if err != nil {
 		return nil, fmt.Errorf("init object search: %w", err)
 	}
@@ -703,6 +723,11 @@ func SearchObjects(prm SearchObjectsPrm) (*SearchObjectsRes, error) {
 		return nil, fmt.Errorf("read object list: %w", err)
 	}
 
+	sort.Slice(list, func(i, j int) bool {
+		lhs, rhs := list[i].EncodeToString(), list[j].EncodeToString()
+		return strings.Compare(lhs, rhs) < 0
+	})
+
 	return &SearchObjectsRes{
 		ids: list,
 	}, nil
@@ -715,7 +740,7 @@ type HashPayloadRangesPrm struct {
 
 	tz bool
 
-	rngs []*object.Range
+	rngs []objectSDK.Range
 
 	salt []byte
 }
@@ -726,7 +751,7 @@ func (x *HashPayloadRangesPrm) TZ() {
 }
 
 // SetRanges sets a list of payload ranges to hash.
-func (x *HashPayloadRangesPrm) SetRanges(rngs []*object.Range) {
+func (x *HashPayloadRangesPrm) SetRanges(rngs []objectSDK.Range) {
 	x.rngs = rngs
 }
 
@@ -749,41 +774,27 @@ func (x HashPayloadRangesRes) HashList() [][]byte {
 //
 // Returns any error which prevented the operation from completing correctly in error return.
 // Returns an error if number of received hashes differs with the number of requested ranges.
-func HashPayloadRanges(prm HashPayloadRangesPrm) (*HashPayloadRangesRes, error) {
-	var cliPrm client.PrmObjectHash
-	cliPrm.FromContainer(prm.objAddr.Container())
-	cliPrm.ByID(prm.objAddr.Object())
-
-	if prm.local {
-		cliPrm.MarkLocal()
-	}
-
-	cliPrm.UseSalt(prm.salt)
-
-	rngs := make([]uint64, 2*len(prm.rngs))
-
-	for i := range prm.rngs {
-		rngs[2*i] = prm.rngs[i].GetOffset()
-		rngs[2*i+1] = prm.rngs[i].GetLength()
-	}
-
-	cliPrm.SetRangeList(rngs...)
-
+func HashPayloadRanges(ctx context.Context, prm HashPayloadRangesPrm) (*HashPayloadRangesRes, error) {
+	cs := checksum.SHA256
 	if prm.tz {
-		cliPrm.TillichZemorAlgo()
+		cs = checksum.TZ
 	}
 
-	if prm.sessionToken != nil {
-		cliPrm.WithinSession(*prm.sessionToken)
+	cnr := prm.objAddr.Container()
+	obj := prm.objAddr.Object()
+	cliPrm := client.PrmObjectHash{
+		ContainerID:  &cnr,
+		ObjectID:     &obj,
+		Local:        prm.local,
+		Salt:         prm.salt,
+		Ranges:       prm.rngs,
+		ChecksumType: cs,
+		Session:      prm.sessionToken,
+		BearerToken:  prm.bearerToken,
+		XHeaders:     prm.xHeaders,
 	}
 
-	if prm.bearerToken != nil {
-		cliPrm.WithBearerToken(*prm.bearerToken)
-	}
-
-	cliPrm.WithXHeaders(prm.xHeaders...)
-
-	res, err := prm.cli.ObjectHash(context.Background(), cliPrm)
+	res, err := prm.cli.ObjectHash(ctx, cliPrm)
 	if err != nil {
 		return nil, fmt.Errorf("read payload hashes via client: %w", err)
 	}
@@ -800,11 +811,11 @@ type PayloadRangePrm struct {
 	rawPrm
 	payloadWriterPrm
 
-	rng *object.Range
+	rng *objectSDK.Range
 }
 
 // SetRange sets payload range to read.
-func (x *PayloadRangePrm) SetRange(rng *object.Range) {
+func (x *PayloadRangePrm) SetRange(rng *objectSDK.Range) {
 	x.rng = rng
 }
 
@@ -817,33 +828,23 @@ type PayloadRangeRes struct{}
 //
 // Returns any error which prevented the operation from completing correctly in error return.
 // For raw reading, returns *object.SplitInfoError error if object is virtual.
-func PayloadRange(prm PayloadRangePrm) (*PayloadRangeRes, error) {
-	var cliPrm client.PrmObjectRange
-	cliPrm.FromContainer(prm.objAddr.Container())
-	cliPrm.ByID(prm.objAddr.Object())
+func PayloadRange(ctx context.Context, prm PayloadRangePrm) (*PayloadRangeRes, error) {
+	cnr := prm.objAddr.Container()
+	obj := prm.objAddr.Object()
 
-	if prm.sessionToken != nil {
-		cliPrm.WithinSession(*prm.sessionToken)
+	rangePrm := client.PrmObjectRange{
+		XHeaders:    prm.xHeaders,
+		BearerToken: prm.bearerToken,
+		Session:     prm.sessionToken,
+		Raw:         prm.raw,
+		Local:       prm.local,
+		ContainerID: &cnr,
+		ObjectID:    &obj,
+		Offset:      prm.rng.GetOffset(),
+		Length:      prm.rng.GetLength(),
 	}
 
-	if prm.bearerToken != nil {
-		cliPrm.WithBearerToken(*prm.bearerToken)
-	}
-
-	if prm.raw {
-		cliPrm.MarkRaw()
-	}
-
-	if prm.local {
-		cliPrm.MarkLocal()
-	}
-
-	cliPrm.SetOffset(prm.rng.GetOffset())
-	cliPrm.SetLength(prm.rng.GetLength())
-
-	cliPrm.WithXHeaders(prm.xHeaders...)
-
-	rdr, err := prm.cli.ObjectRangeInit(context.Background(), cliPrm)
+	rdr, err := prm.cli.ObjectRangeInit(ctx, rangePrm)
 	if err != nil {
 		return nil, fmt.Errorf("init payload reading: %w", err)
 	}
@@ -877,12 +878,12 @@ type SyncContainerRes struct{}
 // Interrupts on any writer error.
 //
 // Panics if a container passed as a parameter is nil.
-func SyncContainerSettings(prm SyncContainerPrm) (*SyncContainerRes, error) {
+func SyncContainerSettings(ctx context.Context, prm SyncContainerPrm) (*SyncContainerRes, error) {
 	if prm.c == nil {
 		panic("sync container settings with the network: nil container")
 	}
 
-	err := client.SyncContainerWithNetwork(context.Background(), prm.c, prm.cli)
+	err := client.SyncContainerWithNetwork(ctx, prm.c, prm.cli)
 	if err != nil {
 		return nil, err
 	}

cmd/frostfs-cli/internal/client/sdk.go

@@ -12,9 +12,11 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/network"
+	tracing "git.frostfs.info/TrueCloudLab/frostfs-observability/tracing/grpc"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"google.golang.org/grpc"
 )
 
 var errInvalidEndpoint = errors.New("provided RPC endpoint is incorrect")
@@ -36,33 +38,37 @@ func getSDKClientByFlag(cmd *cobra.Command, key *ecdsa.PrivateKey, endpointFlag
 	if err != nil {
 		return nil, fmt.Errorf("%v: %w", errInvalidEndpoint, err)
 	}
-	return GetSDKClient(cmd, key, addr)
+	return GetSDKClient(cmd.Context(), cmd, key, addr)
 }
 
 // GetSDKClient returns default frostfs-sdk-go client.
-func GetSDKClient(cmd *cobra.Command, key *ecdsa.PrivateKey, addr network.Address) (*client.Client, error) {
-	var (
-		c       client.Client
-		prmInit client.PrmInit
-		prmDial client.PrmDial
-	)
+func GetSDKClient(ctx context.Context, cmd *cobra.Command, key *ecdsa.PrivateKey, addr network.Address) (*client.Client, error) {
+	var c client.Client
 
-	prmInit.SetDefaultPrivateKey(*key)
-	prmInit.ResolveFrostFSFailures()
-	prmDial.SetServerURI(addr.URIAddr())
+	prmInit := client.PrmInit{
+		Key: *key,
+	}
+
+	prmDial := client.PrmDial{
+		Endpoint: addr.URIAddr(),
+		GRPCDialOptions: []grpc.DialOption{
+			grpc.WithChainUnaryInterceptor(tracing.NewUnaryClientInteceptor()),
+			grpc.WithChainStreamInterceptor(tracing.NewStreamClientInterceptor()),
+		},
+	}
 	if timeout := viper.GetDuration(commonflags.Timeout); timeout > 0 {
 		// In CLI we can only set a timeout for the whole operation.
 		// By also setting stream timeout we ensure that no operation hands
 		// for too long.
-		prmDial.SetTimeout(timeout)
-		prmDial.SetStreamTimeout(timeout)
+		prmDial.DialTimeout = timeout
+		prmDial.StreamTimeout = timeout
 
 		common.PrintVerbose(cmd, "Set request timeout to %s.", timeout)
 	}
 
 	c.Init(prmInit)
 
-	if err := c.Dial(prmDial); err != nil {
+	if err := c.Dial(ctx, prmDial); err != nil {
 		return nil, fmt.Errorf("can't init SDK client: %w", err)
 	}
 
@@ -82,7 +88,7 @@ func GetCurrentEpoch(ctx context.Context, cmd *cobra.Command, endpoint string) (
 		return 0, fmt.Errorf("can't generate key to sign query: %w", err)
 	}
 
-	c, err := GetSDKClient(cmd, key, addr)
+	c, err := GetSDKClient(ctx, cmd, key, addr)
 	if err != nil {
 		return 0, err
 	}

cmd/frostfs-cli/internal/common/tracing.go

@@ -0,0 +1,62 @@
+package common
+
+import (
+	"context"
+	"sort"
+	"strings"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/misc"
+	"git.frostfs.info/TrueCloudLab/frostfs-observability/tracing"
+	"github.com/spf13/cobra"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type spanKey struct{}
+
+// StopClientCommandSpan stops tracing span for the command and prints trace ID on the standard output.
+func StopClientCommandSpan(cmd *cobra.Command, _ []string) {
+	span, ok := cmd.Context().Value(spanKey{}).(trace.Span)
+	if !ok {
+		return
+	}
+
+	span.End()
+
+	// Noop provider cannot fail on flush.
+	_ = tracing.Shutdown(cmd.Context())
+
+	cmd.PrintErrf("Trace ID: %s\n", span.SpanContext().TraceID())
+}
+
+// StartClientCommandSpan starts tracing span for the command.
+func StartClientCommandSpan(cmd *cobra.Command) {
+	enableTracing, err := cmd.Flags().GetBool(commonflags.TracingFlag)
+	if err != nil || !enableTracing {
+		return
+	}
+
+	_, err = tracing.Setup(cmd.Context(), tracing.Config{
+		Enabled:  true,
+		Exporter: tracing.NoOpExporter,
+		Service:  "frostfs-cli",
+		Version:  misc.Version,
+	})
+	commonCmd.ExitOnErr(cmd, "init tracing: %w", err)
+
+	var components sort.StringSlice
+	for c := cmd; c != nil; c = c.Parent() {
+		components = append(components, c.Name())
+	}
+	for i, j := 0, len(components)-1; i < j; {
+		components.Swap(i, j)
+		i++
+		j--
+	}
+
+	operation := strings.Join(components, ".")
+	ctx, span := tracing.StartSpanFromContext(cmd.Context(), operation)
+	ctx = context.WithValue(ctx, spanKey{}, span)
+	cmd.SetContext(ctx)
+}

cmd/frostfs-cli/internal/commonflags/flags.go

@@ -47,6 +47,9 @@ const (
 
 	OIDFlag      = "oid"
 	OIDFlagUsage = "Object ID."
+
+	TracingFlag      = "trace"
+	TracingFlagUsage = "Generate trace ID and print it."
 )
 
 // Init adds common flags to the command:
@@ -54,12 +57,14 @@ const (
 // - WalletPath,
 // - Account,
 // - RPC,
+// - Tracing,
 // - Timeout.
 func Init(cmd *cobra.Command) {
 	InitWithoutRPC(cmd)
 
 	ff := cmd.Flags()
 	ff.StringP(RPC, RPCShorthand, RPCDefault, RPCUsage)
+	ff.Bool(TracingFlag, false, TracingFlagUsage)
 	ff.DurationP(Timeout, TimeoutShorthand, TimeoutDefault, TimeoutUsage)
 }
 

cmd/frostfs-cli/modules/accounting/balance.go

@@ -39,9 +39,9 @@ var accountingBalanceCmd = &cobra.Command{
 
 		var prm internalclient.BalanceOfPrm
 		prm.SetClient(cli)
-		prm.SetAccount(idUser)
+		prm.Account = idUser
 
-		res, err := internalclient.BalanceOf(prm)
+		res, err := internalclient.BalanceOf(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		// print to stdout

cmd/frostfs-cli/modules/acl/extended/create.go

@@ -106,7 +106,7 @@ func createEACL(cmd *cobra.Command, _ []string) {
 		return
 	}
 
-	err = os.WriteFile(outArg, buf.Bytes(), 0644)
+	err = os.WriteFile(outArg, buf.Bytes(), 0o644)
 	if err != nil {
 		cmd.PrintErrln(err)
 		os.Exit(1)

cmd/frostfs-cli/modules/bearer/create.go

@@ -24,6 +24,7 @@ const (
 	ownerFlag          = "owner"
 	outFlag            = "out"
 	jsonFlag           = commonflags.JSON
+	impersonateFlag    = "impersonate"
 )
 
 var createCmd = &cobra.Command{
@@ -39,19 +40,20 @@ is set to current epoch + n.
 }
 
 func init() {
-	createCmd.Flags().StringP(eaclFlag, "e", "", "Path to the extended ACL table")
-	createCmd.Flags().StringP(issuedAtFlag, "i", "", "Epoch to issue token at")
-	createCmd.Flags().StringP(notValidBeforeFlag, "n", "", "Not valid before epoch")
+	createCmd.Flags().StringP(eaclFlag, "e", "", "Path to the extended ACL table (mutually exclusive with --impersonate flag)")
+	createCmd.Flags().StringP(issuedAtFlag, "i", "+0", "Epoch to issue token at")
+	createCmd.Flags().StringP(notValidBeforeFlag, "n", "+0", "Not valid before epoch")
 	createCmd.Flags().StringP(commonflags.ExpireAt, "x", "", "The last active epoch for the token")
 	createCmd.Flags().StringP(ownerFlag, "o", "", "Token owner")
 	createCmd.Flags().String(outFlag, "", "File to write token to")
 	createCmd.Flags().Bool(jsonFlag, false, "Output token in JSON")
+	createCmd.Flags().Bool(impersonateFlag, false, "Mark token as impersonate to consider the token signer as the request owner (mutually exclusive with --eacl flag)")
 	createCmd.Flags().StringP(commonflags.RPC, commonflags.RPCShorthand, commonflags.RPCDefault, commonflags.RPCUsage)
 
+	createCmd.MarkFlagsMutuallyExclusive(eaclFlag, impersonateFlag)
+
 	_ = cobra.MarkFlagFilename(createCmd.Flags(), eaclFlag)
 
-	_ = cobra.MarkFlagRequired(createCmd.Flags(), issuedAtFlag)
-	_ = cobra.MarkFlagRequired(createCmd.Flags(), notValidBeforeFlag)
 	_ = cobra.MarkFlagRequired(createCmd.Flags(), commonflags.ExpireAt)
 	_ = cobra.MarkFlagRequired(createCmd.Flags(), ownerFlag)
 	_ = cobra.MarkFlagRequired(createCmd.Flags(), outFlag)
@@ -68,10 +70,14 @@ func createToken(cmd *cobra.Command, _ []string) {
 	commonCmd.ExitOnErr(cmd, "can't parse --"+notValidBeforeFlag+" flag: %w", err)
 
 	if iatRelative || expRelative || nvbRelative {
+		endpoint, _ := cmd.Flags().GetString(commonflags.RPC)
+		if len(endpoint) == 0 {
+			commonCmd.ExitOnErr(cmd, "can't fetch current epoch: %w", fmt.Errorf("'%s' flag value must be specified", commonflags.RPC))
+		}
+
 		ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
 		defer cancel()
 
-		endpoint, _ := cmd.Flags().GetString(commonflags.RPC)
 		currEpoch, err := internalclient.GetCurrentEpoch(ctx, cmd, endpoint)
 		commonCmd.ExitOnErr(cmd, "can't fetch current epoch: %w", err)
 
@@ -101,6 +107,9 @@ func createToken(cmd *cobra.Command, _ []string) {
 	b.SetIat(iat)
 	b.ForUser(ownerID)
 
+	impersonate, _ := cmd.Flags().GetBool(impersonateFlag)
+	b.SetImpersonate(impersonate)
+
 	eaclPath, _ := cmd.Flags().GetString(eaclFlag)
 	if eaclPath != "" {
 		table := eaclSDK.NewTable()
@@ -121,6 +130,6 @@ func createToken(cmd *cobra.Command, _ []string) {
 	}
 
 	out, _ := cmd.Flags().GetString(outFlag)
-	err = os.WriteFile(out, data, 0644)
+	err = os.WriteFile(out, data, 0o644)
 	commonCmd.ExitOnErr(cmd, "can't write token to file: %w", err)
 }

cmd/frostfs-cli/modules/container/create.go

@@ -13,10 +13,10 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
-	subnetid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/subnet/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	"github.com/spf13/cobra"
 )
@@ -30,7 +30,6 @@ var (
 	containerNnsName     string
 	containerNnsZone     string
 	containerNoTimestamp bool
-	containerSubnet      string
 	force                bool
 )
 
@@ -50,7 +49,7 @@ It will be stored in sidechain when inner ring will accepts it.`,
 			var prm internalclient.NetMapSnapshotPrm
 			prm.SetClient(cli)
 
-			resmap, err := internalclient.NetMapSnapshot(prm)
+			resmap, err := internalclient.NetMapSnapshot(cmd.Context(), prm)
 			commonCmd.ExitOnErr(cmd, "unable to get netmap snapshot to validate container placement, "+
 				"use --force option to skip this check: %w", err)
 
@@ -70,15 +69,6 @@ It will be stored in sidechain when inner ring will accepts it.`,
 			}
 		}
 
-		if containerSubnet != "" {
-			var subnetID subnetid.ID
-
-			err = subnetID.DecodeString(containerSubnet)
-			commonCmd.ExitOnErr(cmd, "could not parse subnetID: %w", err)
-
-			placementPolicy.RestrictSubnet(subnetID)
-		}
-
 		var cnr container.Container
 		cnr.Init()
 
@@ -107,18 +97,18 @@ It will be stored in sidechain when inner ring will accepts it.`,
 		syncContainerPrm.SetClient(cli)
 		syncContainerPrm.SetContainer(&cnr)
 
-		_, err = internalclient.SyncContainerSettings(syncContainerPrm)
+		_, err = internalclient.SyncContainerSettings(cmd.Context(), syncContainerPrm)
 		commonCmd.ExitOnErr(cmd, "syncing container's settings rpc error: %w", err)
 
-		var putPrm internalclient.PutContainerPrm
-		putPrm.SetClient(cli)
-		putPrm.SetContainer(cnr)
-
-		if tok != nil {
-			putPrm.WithinSession(*tok)
+		putPrm := internalclient.PutContainerPrm{
+			Client: cli,
+			ClientParams: client.PrmContainerPut{
+				Container: &cnr,
+				Session:   tok,
+			},
 		}
 
-		res, err := internalclient.PutContainer(putPrm)
+		res, err := internalclient.PutContainer(cmd.Context(), putPrm)
 		commonCmd.ExitOnErr(cmd, "put container rpc error: %w", err)
 
 		id := res.ID()
@@ -128,14 +118,17 @@ It will be stored in sidechain when inner ring will accepts it.`,
 		if containerAwait {
 			cmd.Println("awaiting...")
 
-			var getPrm internalclient.GetContainerPrm
-			getPrm.SetClient(cli)
-			getPrm.SetContainer(id)
+			getPrm := internalclient.GetContainerPrm{
+				Client: cli,
+				ClientParams: client.PrmContainerGet{
+					ContainerID: &id,
+				},
+			}
 
 			for i := 0; i < awaitTimeout; i++ {
 				time.Sleep(1 * time.Second)
 
-				_, err := internalclient.GetContainer(getPrm)
+				_, err := internalclient.GetContainer(cmd.Context(), getPrm)
 				if err == nil {
 					cmd.Println("container has been persisted on sidechain")
 					return
@@ -152,6 +145,7 @@ func initContainerCreateCmd() {
 
 	// Init common flags
 	flags.StringP(commonflags.RPC, commonflags.RPCShorthand, commonflags.RPCDefault, commonflags.RPCUsage)
+	flags.Bool(commonflags.TracingFlag, false, commonflags.TracingFlagUsage)
 	flags.DurationP(commonflags.Timeout, commonflags.TimeoutShorthand, commonflags.TimeoutDefault, commonflags.TimeoutUsage)
 	flags.StringP(commonflags.WalletPath, commonflags.WalletPathShorthand, commonflags.WalletPathDefault, commonflags.WalletPathUsage)
 	flags.StringP(commonflags.Account, commonflags.AccountShorthand, commonflags.AccountDefault, commonflags.AccountUsage)
@@ -166,7 +160,6 @@ func initContainerCreateCmd() {
 	flags.StringVar(&containerNnsName, "nns-name", "", "Container nns name attribute")
 	flags.StringVar(&containerNnsZone, "nns-zone", "", "Container nns zone attribute")
 	flags.BoolVar(&containerNoTimestamp, "disable-timestamp", false, "Disable timestamp container attribute")
-	flags.StringVar(&containerSubnet, "subnet", "", "String representation of container subnetwork")
 	flags.BoolVarP(&force, commonflags.ForceFlag, commonflags.ForceFlagShorthand, false,
 		"Skip placement validity check")
 }
@@ -192,12 +185,12 @@ func parseContainerPolicy(cmd *cobra.Command, policyString string) (*netmap.Plac
 		return &result, nil
 	}
 
-	if err = result.UnmarshalJSON([]byte(policyString)); err == nil {
+	if err := result.UnmarshalJSON([]byte(policyString)); err == nil {
 		common.PrintVerbose(cmd, "Parsed JSON encoded policy")
 		return &result, nil
 	}
 
-	return nil, errors.New("can't parse placement policy")
+	return nil, fmt.Errorf("can't parse placement policy: %w", err)
 }
 
 func parseAttributes(dst *container.Container, attributes []string) error {

cmd/frostfs-cli/modules/container/delete.go

@@ -9,6 +9,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	"github.com/spf13/cobra"
@@ -30,11 +31,14 @@ Only owner of the container has a permission to remove container.`,
 		if force, _ := cmd.Flags().GetBool(commonflags.ForceFlag); !force {
 			common.PrintVerbose(cmd, "Reading the container to check ownership...")
 
-			var getPrm internalclient.GetContainerPrm
-			getPrm.SetClient(cli)
-			getPrm.SetContainer(id)
+			getPrm := internalclient.GetContainerPrm{
+				Client: cli,
+				ClientParams: client.PrmContainerGet{
+					ContainerID: &id,
+				},
+			}
 
-			resGet, err := internalclient.GetContainer(getPrm)
+			resGet, err := internalclient.GetContainer(cmd.Context(), getPrm)
 			commonCmd.ExitOnErr(cmd, "can't get the container: %w", err)
 
 			owner := resGet.Container().Owner()
@@ -72,7 +76,7 @@ Only owner of the container has a permission to remove container.`,
 
 				common.PrintVerbose(cmd, "Searching for LOCK objects...")
 
-				res, err := internalclient.SearchObjects(searchPrm)
+				res, err := internalclient.SearchObjects(cmd.Context(), searchPrm)
 				commonCmd.ExitOnErr(cmd, "can't search for LOCK objects: %w", err)
 
 				if len(res.IDList()) != 0 {
@@ -83,15 +87,15 @@ Only owner of the container has a permission to remove container.`,
 			}
 		}
 
-		var delPrm internalclient.DeleteContainerPrm
-		delPrm.SetClient(cli)
-		delPrm.SetContainer(id)
-
-		if tok != nil {
-			delPrm.WithinSession(*tok)
+		delPrm := internalclient.DeleteContainerPrm{
+			Client: cli,
+			ClientParams: client.PrmContainerDelete{
+				ContainerID: &id,
+				Session:     tok,
+			},
 		}
 
-		_, err := internalclient.DeleteContainer(delPrm)
+		_, err := internalclient.DeleteContainer(cmd.Context(), delPrm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		cmd.Println("container delete method invoked")
@@ -99,14 +103,17 @@ Only owner of the container has a permission to remove container.`,
 		if containerAwait {
 			cmd.Println("awaiting...")
 
-			var getPrm internalclient.GetContainerPrm
-			getPrm.SetClient(cli)
-			getPrm.SetContainer(id)
+			getPrm := internalclient.GetContainerPrm{
+				Client: cli,
+				ClientParams: client.PrmContainerGet{
+					ContainerID: &id,
+				},
+			}
 
 			for i := 0; i < awaitTimeout; i++ {
 				time.Sleep(1 * time.Second)
 
-				_, err := internalclient.GetContainer(getPrm)
+				_, err := internalclient.GetContainer(cmd.Context(), getPrm)
 				if err != nil {
 					cmd.Println("container has been removed:", containerID)
 					return
@@ -124,6 +131,7 @@ func initContainerDeleteCmd() {
 	flags.StringP(commonflags.WalletPath, commonflags.WalletPathShorthand, commonflags.WalletPathDefault, commonflags.WalletPathUsage)
 	flags.StringP(commonflags.Account, commonflags.AccountShorthand, commonflags.AccountDefault, commonflags.AccountUsage)
 	flags.StringP(commonflags.RPC, commonflags.RPCShorthand, commonflags.RPCDefault, commonflags.RPCUsage)
+	flags.Bool(commonflags.TracingFlag, false, commonflags.TracingFlagUsage)
 
 	flags.StringVar(&containerID, commonflags.CIDFlag, "", commonflags.CIDFlagUsage)
 	flags.BoolVar(&containerAwait, "await", false, "Block execution until container is removed")

cmd/frostfs-cli/modules/container/get.go

@@ -10,6 +10,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/util"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
@@ -50,7 +51,7 @@ var getContainerInfoCmd = &cobra.Command{
 				data = cnr.Marshal()
 			}
 
-			err = os.WriteFile(containerPathTo, data, 0644)
+			err = os.WriteFile(containerPathTo, data, 0o644)
 			commonCmd.ExitOnErr(cmd, "can't write container to file: %w", err)
 		}
 	},
@@ -147,11 +148,14 @@ func getContainer(cmd *cobra.Command) (container.Container, *ecdsa.PrivateKey) {
 		pk = key.GetOrGenerate(cmd)
 		cli := internalclient.GetSDKClientByFlag(cmd, pk, commonflags.RPC)
 
-		var prm internalclient.GetContainerPrm
-		prm.SetClient(cli)
-		prm.SetContainer(id)
+		prm := internalclient.GetContainerPrm{
+			Client: cli,
+			ClientParams: client.PrmContainerGet{
+				ContainerID: &id,
+			},
+		}
 
-		res, err := internalclient.GetContainer(prm)
+		res, err := internalclient.GetContainer(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		cnr = res.Container()

cmd/frostfs-cli/modules/container/get_eacl.go

@@ -8,6 +8,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"github.com/spf13/cobra"
 )
 
@@ -20,11 +21,14 @@ var getExtendedACLCmd = &cobra.Command{
 		pk := key.GetOrGenerate(cmd)
 		cli := internalclient.GetSDKClientByFlag(cmd, pk, commonflags.RPC)
 
-		var eaclPrm internalclient.EACLPrm
-		eaclPrm.SetClient(cli)
-		eaclPrm.SetContainer(id)
+		eaclPrm := internalclient.EACLPrm{
+			Client: cli,
+			ClientParams: client.PrmContainerEACL{
+				ContainerID: &id,
+			},
+		}
 
-		res, err := internalclient.EACL(eaclPrm)
+		res, err := internalclient.EACL(cmd.Context(), eaclPrm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		eaclTable := res.EACL()
@@ -48,7 +52,7 @@ var getExtendedACLCmd = &cobra.Command{
 
 		cmd.Println("dumping data to file:", containerPathTo)
 
-		err = os.WriteFile(containerPathTo, data, 0644)
+		err = os.WriteFile(containerPathTo, data, 0o644)
 		commonCmd.ExitOnErr(cmd, "could not write eACL to file: %w", err)
 	},
 }

cmd/frostfs-cli/modules/container/list.go

@@ -8,6 +8,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	containerSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	"github.com/spf13/cobra"
 )
@@ -16,12 +17,14 @@ import (
 const (
 	flagListPrintAttr      = "with-attr"
 	flagListContainerOwner = "owner"
+	flagListName           = "name"
 )
 
 // flag vars of list command.
 var (
 	flagVarListPrintAttr      bool
 	flagVarListContainerOwner string
+	flagVarListName           string
 )
 
 var listContainersCmd = &cobra.Command{
@@ -44,32 +47,44 @@ var listContainersCmd = &cobra.Command{
 
 		var prm internalclient.ListContainersPrm
 		prm.SetClient(cli)
-		prm.SetAccount(idUser)
+		prm.Account = idUser
 
-		res, err := internalclient.ListContainers(prm)
+		res, err := internalclient.ListContainers(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
-		var prmGet internalclient.GetContainerPrm
-		prmGet.SetClient(cli)
+		prmGet := internalclient.GetContainerPrm{
+			Client: cli,
+		}
 
-		list := res.IDList()
-		for i := range list {
-			cmd.Println(list[i].String())
+		containerIDs := res.SortedIDList()
+		for _, cnrID := range containerIDs {
+			if flagVarListName == "" && !flagVarListPrintAttr {
+				cmd.Println(cnrID.String())
+				continue
+			}
+
+			cnrID := cnrID
+			prmGet.ClientParams.ContainerID = &cnrID
+			res, err := internalclient.GetContainer(cmd.Context(), prmGet)
+			if err != nil {
+				cmd.Printf("  failed to read attributes: %v\n", err)
+				continue
+			}
+
+			cnr := res.Container()
+			if cnrName := containerSDK.Name(cnr); flagVarListName != "" && cnrName != flagVarListName {
+				continue
+			}
+			cmd.Println(cnrID.String())
 
 			if flagVarListPrintAttr {
-				prmGet.SetContainer(list[i])
-
-				res, err := internalclient.GetContainer(prmGet)
-				if err == nil {
-					res.Container().IterateAttributes(func(key, val string) {
-						if !strings.HasPrefix(key, container.SysAttributePrefix) && !strings.HasPrefix(key, container.SysAttributePrefixNeoFS) {
-							// FIXME(@cthulhu-rider): neofs-sdk-go#314 use dedicated method to skip system attributes
-							cmd.Printf("  %s: %s\n", key, val)
-						}
-					})
-				} else {
-					cmd.Printf("  failed to read attributes: %v\n", err)
-				}
+				cnr.IterateAttributes(func(key, val string) {
+					if !strings.HasPrefix(key, container.SysAttributePrefix) && !strings.HasPrefix(key, container.SysAttributePrefixNeoFS) {
+						// FIXME(@cthulhu-rider): https://git.frostfs.info/TrueCloudLab/frostfs-sdk-go/issues/97
+						//	Use dedicated method to skip system attributes.
+						cmd.Printf("  %s: %s\n", key, val)
+					}
+				})
 			}
 		}
 	},
@@ -80,6 +95,9 @@ func initContainerListContainersCmd() {
 
 	flags := listContainersCmd.Flags()
 
+	flags.StringVar(&flagVarListName, flagListName, "",
+		"List containers by the attribute name",
+	)
 	flags.StringVar(&flagVarListContainerOwner, flagListContainerOwner, "",
 		"Owner of containers (omit to use owner from private key)",
 	)

cmd/frostfs-cli/modules/container/list_objects.go

@@ -9,7 +9,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	objectCli "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/object"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
+	objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"github.com/spf13/cobra"
 )
@@ -31,7 +31,7 @@ var listContainerObjectsCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		id := parseContainerID(cmd)
 
-		filters := new(object.SearchFilters)
+		filters := new(objectSDK.SearchFilters)
 		filters.AddRootFilter() // search only user created objects
 
 		cli := internalclient.GetSDKClientByFlag(cmd, key.GetOrGenerate(cmd), commonflags.RPC)
@@ -51,7 +51,7 @@ var listContainerObjectsCmd = &cobra.Command{
 		prmSearch.SetContainerID(id)
 		prmSearch.SetFilters(*filters)
 
-		res, err := internalclient.SearchObjects(prmSearch)
+		res, err := internalclient.SearchObjects(cmd.Context(), prmSearch)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		objectIDs := res.IDList()
@@ -65,13 +65,14 @@ var listContainerObjectsCmd = &cobra.Command{
 				addr.SetObject(objectIDs[i])
 				prmHead.SetAddress(addr)
 
-				resHead, err := internalclient.HeadObject(prmHead)
+				resHead, err := internalclient.HeadObject(cmd.Context(), prmHead)
 				if err == nil {
 					attrs := resHead.Header().Attributes()
 					for i := range attrs {
 						attrKey := attrs[i].Key()
 						if !strings.HasPrefix(attrKey, v2object.SysAttributePrefix) && !strings.HasPrefix(attrKey, v2object.SysAttributePrefixNeoFS) {
-							// FIXME(@cthulhu-rider): neofs-sdk-go#226 use dedicated method to skip system attributes
+							// FIXME(@cthulhu-rider): https://git.frostfs.info/TrueCloudLab/frostfs-sdk-go/issues/97
+							//	Use dedicated method to skip system attributes.
 							cmd.Printf("  %s: %s\n", attrKey, attrs[i].Value())
 						}
 					}

cmd/frostfs-cli/modules/container/nodes.go

@@ -20,7 +20,7 @@ var containerNodesCmd = &cobra.Command{
 	Short: "Show nodes for container",
 	Long:  "Show nodes taking part in a container at the current epoch.",
 	Run: func(cmd *cobra.Command, args []string) {
-		var cnr, pkey = getContainer(cmd)
+		cnr, pkey := getContainer(cmd)
 
 		if pkey == nil {
 			pkey = key.GetOrGenerate(cmd)
@@ -31,7 +31,7 @@ var containerNodesCmd = &cobra.Command{
 		var prm internalclient.NetMapSnapshotPrm
 		prm.SetClient(cli)
 
-		resmap, err := internalclient.NetMapSnapshot(prm)
+		resmap, err := internalclient.NetMapSnapshot(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "unable to get netmap snapshot", err)
 
 		var id cid.ID

cmd/frostfs-cli/modules/container/policy_playground.go

@@ -0,0 +1,233 @@
+package container
+
+import (
+	"bufio"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	internalclient "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+type policyPlaygroundREPL struct {
+	cmd   *cobra.Command
+	args  []string
+	nodes map[string]netmap.NodeInfo
+}
+
+func newPolicyPlaygroundREPL(cmd *cobra.Command, args []string) (*policyPlaygroundREPL, error) {
+	return &policyPlaygroundREPL{
+		cmd:   cmd,
+		args:  args,
+		nodes: map[string]netmap.NodeInfo{},
+	}, nil
+}
+
+func (repl *policyPlaygroundREPL) handleLs(args []string) error {
+	if len(args) > 0 {
+		return fmt.Errorf("too many arguments for command 'ls': got %d, want 0", len(args))
+	}
+	i := 1
+	for id, node := range repl.nodes {
+		var attrs []string
+		node.IterateAttributes(func(k, v string) {
+			attrs = append(attrs, fmt.Sprintf("%s:%q", k, v))
+		})
+		fmt.Printf("\t%2d: id=%s attrs={%v}\n", i, id, strings.Join(attrs, " "))
+		i++
+	}
+	return nil
+}
+
+func (repl *policyPlaygroundREPL) handleAdd(args []string) error {
+	if len(args) == 0 {
+		return fmt.Errorf("too few arguments for command 'add': got %d, want >0", len(args))
+	}
+	id := args[0]
+	key, err := hex.DecodeString(id)
+	if err != nil {
+		return fmt.Errorf("node id must be a hex string: got %q: %v", id, err)
+	}
+	node := repl.nodes[id]
+	node.SetPublicKey(key)
+	for _, attr := range args[1:] {
+		kv := strings.Split(attr, ":")
+		if len(kv) != 2 {
+			return fmt.Errorf("node attributes must be in the format 'KEY:VALUE': got %q", attr)
+		}
+		node.SetAttribute(kv[0], kv[1])
+	}
+	repl.nodes[id] = node
+	return nil
+}
+
+func (repl *policyPlaygroundREPL) handleLoad(args []string) error {
+	if len(args) != 1 {
+		return fmt.Errorf("too few arguments for command 'add': got %d, want 1", len(args))
+	}
+
+	jsonNetmap := map[string]map[string]string{}
+
+	b, err := os.ReadFile(args[0])
+	if err != nil {
+		return fmt.Errorf("reading netmap file %q: %v", args[0], err)
+	}
+
+	if err := json.Unmarshal(b, &jsonNetmap); err != nil {
+		return fmt.Errorf("decoding json netmap: %v", err)
+	}
+
+	repl.nodes = make(map[string]netmap.NodeInfo)
+	for id, attrs := range jsonNetmap {
+		key, err := hex.DecodeString(id)
+		if err != nil {
+			return fmt.Errorf("node id must be a hex string: got %q: %v", id, err)
+		}
+
+		node := repl.nodes[id]
+		node.SetPublicKey(key)
+		for k, v := range attrs {
+			node.SetAttribute(k, v)
+		}
+		repl.nodes[id] = node
+	}
+
+	return nil
+}
+
+func (repl *policyPlaygroundREPL) handleRemove(args []string) error {
+	if len(args) == 0 {
+		return fmt.Errorf("too few arguments for command 'remove': got %d, want >0", len(args))
+	}
+	id := args[0]
+	if _, exists := repl.nodes[id]; exists {
+		delete(repl.nodes, id)
+		return nil
+	}
+	return fmt.Errorf("node not found: id=%q", id)
+}
+
+func (repl *policyPlaygroundREPL) handleEval(args []string) error {
+	policyStr := strings.TrimSpace(strings.Join(args, " "))
+	var nodes [][]netmap.NodeInfo
+	nm := repl.netMap()
+
+	if strings.HasPrefix(policyStr, "CBF") || strings.HasPrefix(policyStr, "SELECT") || strings.HasPrefix(policyStr, "FILTER") {
+		// Assume that the input is a partial SELECT-FILTER expression.
+		// Full inline policies always start with UNIQUE or REP keywords,
+		// or different prefixes when it's the case of an external file.
+		sfExpr, err := netmap.DecodeSelectFilterString(policyStr)
+		if err != nil {
+			return fmt.Errorf("parsing select-filter expression: %v", err)
+		}
+		nodes, err = nm.SelectFilterNodes(sfExpr)
+		if err != nil {
+			return fmt.Errorf("building select-filter nodes: %v", err)
+		}
+	} else {
+		// Assume that the input is a full policy or input file otherwise.
+		placementPolicy, err := parseContainerPolicy(repl.cmd, policyStr)
+		if err != nil {
+			return fmt.Errorf("parsing placement policy: %v", err)
+		}
+		nodes, err = nm.ContainerNodes(*placementPolicy, nil)
+		if err != nil {
+			return fmt.Errorf("building container nodes: %v", err)
+		}
+	}
+	for i, ns := range nodes {
+		var ids []string
+		for _, node := range ns {
+			ids = append(ids, hex.EncodeToString(node.PublicKey()))
+		}
+		fmt.Printf("\t%2d: %v\n", i+1, ids)
+	}
+
+	return nil
+}
+
+func (repl *policyPlaygroundREPL) netMap() netmap.NetMap {
+	var nm netmap.NetMap
+	var nodes []netmap.NodeInfo
+	for _, node := range repl.nodes {
+		nodes = append(nodes, node)
+	}
+	nm.SetNodes(nodes)
+	return nm
+}
+
+func (repl *policyPlaygroundREPL) run() error {
+	if len(viper.GetString(commonflags.RPC)) > 0 {
+		key := key.GetOrGenerate(repl.cmd)
+		cli := internalclient.GetSDKClientByFlag(repl.cmd, key, commonflags.RPC)
+
+		var prm internalclient.NetMapSnapshotPrm
+		prm.SetClient(cli)
+
+		resp, err := internalclient.NetMapSnapshot(repl.cmd.Context(), prm)
+		commonCmd.ExitOnErr(repl.cmd, "unable to get netmap snapshot to populate initial netmap: %w", err)
+
+		for _, node := range resp.NetMap().Nodes() {
+			id := hex.EncodeToString(node.PublicKey())
+			repl.nodes[id] = node
+		}
+	}
+
+	cmdHandlers := map[string]func([]string) error{
+		"list":   repl.handleLs,
+		"ls":     repl.handleLs,
+		"add":    repl.handleAdd,
+		"load":   repl.handleLoad,
+		"remove": repl.handleRemove,
+		"rm":     repl.handleRemove,
+		"eval":   repl.handleEval,
+	}
+	for reader := bufio.NewReader(os.Stdin); ; {
+		fmt.Print("> ")
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			if err == io.EOF {
+				return nil
+			}
+			return fmt.Errorf("reading line: %v", err)
+		}
+		parts := strings.Fields(line)
+		if len(parts) == 0 {
+			continue
+		}
+		cmd := parts[0]
+		handler, exists := cmdHandlers[cmd]
+		if exists {
+			if err := handler(parts[1:]); err != nil {
+				fmt.Printf("error: %v\n", err)
+			}
+		} else {
+			fmt.Printf("error: unknown command %q\n", cmd)
+		}
+	}
+}
+
+var policyPlaygroundCmd = &cobra.Command{
+	Use:   "policy-playground",
+	Short: "A REPL for testing placement policies",
+	Long: `A REPL for testing placement policies.
+If a wallet and endpoint is provided, the initial netmap data will be loaded from the snapshot of the node. Otherwise, an empty playground is created.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		repl, err := newPolicyPlaygroundREPL(cmd, args)
+		commonCmd.ExitOnErr(cmd, "could not create policy playground: %w", err)
+		commonCmd.ExitOnErr(cmd, "policy playground failed: %w", repl.run())
+	},
+}
+
+func initContainerPolicyPlaygroundCmd() {
+	commonflags.Init(policyPlaygroundCmd)
+}

cmd/frostfs-cli/modules/container/root.go

@@ -28,6 +28,7 @@ func init() {
 		getExtendedACLCmd,
 		setExtendedACLCmd,
 		containerNodesCmd,
+		policyPlaygroundCmd,
 	}
 
 	Cmd.AddCommand(containerChildCommand...)
@@ -40,6 +41,7 @@ func init() {
 	initContainerGetEACLCmd()
 	initContainerSetEACLCmd()
 	initContainerNodesCmd()
+	initContainerPolicyPlaygroundCmd()
 
 	for _, containerCommand := range containerChildCommand {
 		commonflags.InitAPI(containerCommand)

cmd/frostfs-cli/modules/container/set_eacl.go

@@ -10,6 +10,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"github.com/spf13/cobra"
 )
 
@@ -38,7 +39,7 @@ Container ID in EACL table will be substituted with ID from the CLI.`,
 		if !flagVarsSetEACL.noPreCheck {
 			cmd.Println("Checking the ability to modify access rights in the container...")
 
-			extendable, err := internalclient.IsACLExtendable(cli, id)
+			extendable, err := internalclient.IsACLExtendable(cmd.Context(), cli, id)
 			commonCmd.ExitOnErr(cmd, "Extensibility check failure: %w", err)
 
 			if !extendable {
@@ -48,15 +49,15 @@ Container ID in EACL table will be substituted with ID from the CLI.`,
 			cmd.Println("ACL extension is enabled in the container, continue processing.")
 		}
 
-		var setEACLPrm internalclient.SetEACLPrm
-		setEACLPrm.SetClient(cli)
-		setEACLPrm.SetTable(*eaclTable)
-
-		if tok != nil {
-			setEACLPrm.WithinSession(*tok)
+		setEACLPrm := internalclient.SetEACLPrm{
+			Client: cli,
+			ClientParams: client.PrmContainerSetEACL{
+				Table:   eaclTable,
+				Session: tok,
+			},
 		}
 
-		_, err := internalclient.SetEACL(setEACLPrm)
+		_, err := internalclient.SetEACL(cmd.Context(), setEACLPrm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		if containerAwait {
@@ -65,14 +66,17 @@ Container ID in EACL table will be substituted with ID from the CLI.`,
 
 			cmd.Println("awaiting...")
 
-			var getEACLPrm internalclient.EACLPrm
-			getEACLPrm.SetClient(cli)
-			getEACLPrm.SetContainer(id)
+			getEACLPrm := internalclient.EACLPrm{
+				Client: cli,
+				ClientParams: client.PrmContainerEACL{
+					ContainerID: &id,
+				},
+			}
 
 			for i := 0; i < awaitTimeout; i++ {
 				time.Sleep(1 * time.Second)
 
-				res, err := internalclient.EACL(getEACLPrm)
+				res, err := internalclient.EACL(cmd.Context(), getEACLPrm)
 				if err == nil {
 					// compare binary values because EACL could have been set already
 					table := res.EACL()

cmd/frostfs-cli/modules/control/add_rule.go

@@ -0,0 +1,94 @@
+package control
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/json"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/util"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
+	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
+	"github.com/spf13/cobra"
+)
+
+const (
+	ruleFlag = "rule"
+)
+
+var addRuleCmd = &cobra.Command{
+	Use:   "add-rule",
+	Short: "Add local override",
+	Long:  "Add local APE rule to a node with following format:\n<action>[:action_detail] <operation> [<condition1> ...] <resource>",
+	Example: `allow Object.Get *
+deny Object.Get EbxzAdz5LB4uqxuz6crWKAumBNtZyK2rKsqQP7TdZvwr/*
+deny:QuotaLimitReached Object.Put Object.Resource:Department=HR *
+`,
+	Run: addRule,
+}
+
+func prettyJSONFormat(cmd *cobra.Command, serializedChain []byte) string {
+	wr := bytes.NewBufferString("")
+	err := json.Indent(wr, serializedChain, "", " ")
+	commonCmd.ExitOnErr(cmd, "%w", err)
+	return wr.String()
+}
+
+func addRule(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+
+	chainID, _ := cmd.Flags().GetString(chainIDFlag)
+
+	var cnr cid.ID
+	cidStr, _ := cmd.Flags().GetString(commonflags.CIDFlag)
+	commonCmd.ExitOnErr(cmd, "can't decode container ID: %w", cnr.DecodeString(cidStr))
+
+	rawCID := make([]byte, sha256.Size)
+	cnr.Encode(rawCID)
+
+	rule, _ := cmd.Flags().GetString(ruleFlag)
+
+	chain := new(apechain.Chain)
+	commonCmd.ExitOnErr(cmd, "parser error: %w", util.ParseAPEChain(chain, []string{rule}))
+	chain.ID = apechain.ID(chainID)
+	serializedChain := chain.Bytes()
+
+	cmd.Println("Container ID: " + cidStr)
+	cmd.Println("Parsed chain:\n" + prettyJSONFormat(cmd, serializedChain))
+
+	req := &control.AddChainLocalOverrideRequest{
+		Body: &control.AddChainLocalOverrideRequest_Body{
+			ContainerId: rawCID,
+			Chain:       serializedChain,
+		},
+	}
+
+	signRequest(cmd, pk, req)
+
+	cli := getClient(cmd, pk)
+
+	var resp *control.AddChainLocalOverrideResponse
+	var err error
+	err = cli.ExecRaw(func(client *client.Client) error {
+		resp, err = control.AddChainLocalOverride(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	cmd.Println("Rule has been added. Chain id: ", resp.GetBody().GetChainId())
+}
+
+func initControlAddRuleCmd() {
+	initControlFlags(addRuleCmd)
+
+	ff := addRuleCmd.Flags()
+	ff.String(commonflags.CIDFlag, "", commonflags.CIDFlagUsage)
+	ff.String(ruleFlag, "", "Rule statement")
+	ff.String(chainIDFlag, "", "Assign ID to the parsed chain")
+}

cmd/frostfs-cli/modules/control/evacuate_shard.go

@@ -8,11 +8,14 @@ import (
 	"github.com/spf13/cobra"
 )
 
+const ignoreErrorsFlag = "no-errors"
+
 var evacuateShardCmd = &cobra.Command{
-	Use:   "evacuate",
-	Short: "Evacuate objects from shard",
-	Long:  "Evacuate objects from shard to other shards",
-	Run:   evacuateShard,
+	Use:        "evacuate",
+	Short:      "Evacuate objects from shard",
+	Long:       "Evacuate objects from shard to other shards",
+	Run:        evacuateShard,
+	Deprecated: "use frostfs-cli control shards evacuation start",
 }
 
 func evacuateShard(cmd *cobra.Command, _ []string) {
@@ -20,7 +23,7 @@ func evacuateShard(cmd *cobra.Command, _ []string) {
 
 	req := &control.EvacuateShardRequest{Body: new(control.EvacuateShardRequest_Body)}
 	req.Body.Shard_ID = getShardIDList(cmd)
-	req.Body.IgnoreErrors, _ = cmd.Flags().GetBool(dumpIgnoreErrorsFlag)
+	req.Body.IgnoreErrors, _ = cmd.Flags().GetBool(ignoreErrorsFlag)
 
 	signRequest(cmd, pk, req)
 
@@ -47,7 +50,7 @@ func initControlEvacuateShardCmd() {
 	flags := evacuateShardCmd.Flags()
 	flags.StringSlice(shardIDFlag, nil, "List of shard IDs in base58 encoding")
 	flags.Bool(shardAllFlag, false, "Process all shards")
-	flags.Bool(dumpIgnoreErrorsFlag, false, "Skip invalid/unreadable objects")
+	flags.Bool(ignoreErrorsFlag, false, "Skip invalid/unreadable objects")
 
 	evacuateShardCmd.MarkFlagsMutuallyExclusive(shardIDFlag, shardAllFlag)
 }

cmd/frostfs-cli/modules/control/evacuation.go

@@ -0,0 +1,316 @@
+package control
+
+import (
+	"crypto/ecdsa"
+	"fmt"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/local_object_storage/shard"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
+	clientSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
+	"github.com/spf13/cobra"
+)
+
+const (
+	awaitFlag      = "await"
+	noProgressFlag = "no-progress"
+)
+
+var evacuationShardCmd = &cobra.Command{
+	Use:   "evacuation",
+	Short: "Objects evacuation from shard",
+	Long:  "Objects evacuation from shard to other shards",
+}
+
+var startEvacuationShardCmd = &cobra.Command{
+	Use:   "start",
+	Short: "Start evacuate objects from shard",
+	Long:  "Start evacuate objects from shard to other shards",
+	Run:   startEvacuateShard,
+}
+
+var getEvacuationShardStatusCmd = &cobra.Command{
+	Use:   "status",
+	Short: "Get evacuate objects from shard status",
+	Long:  "Get evacuate objects from shard to other shards status",
+	Run:   getEvacuateShardStatus,
+}
+
+var stopEvacuationShardCmd = &cobra.Command{
+	Use:   "stop",
+	Short: "Stop running evacuate process",
+	Long:  "Stop running evacuate process from shard to other shards",
+	Run:   stopEvacuateShardStatus,
+}
+
+func startEvacuateShard(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+
+	ignoreErrors, _ := cmd.Flags().GetBool(ignoreErrorsFlag)
+
+	req := &control.StartShardEvacuationRequest{
+		Body: &control.StartShardEvacuationRequest_Body{
+			Shard_ID:     getShardIDList(cmd),
+			IgnoreErrors: ignoreErrors,
+		},
+	}
+
+	signRequest(cmd, pk, req)
+
+	cli := getClient(cmd, pk)
+
+	var resp *control.StartShardEvacuationResponse
+	var err error
+	err = cli.ExecRaw(func(client *client.Client) error {
+		resp, err = control.StartShardEvacuation(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "Start evacuate shards failed, rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	cmd.Println("Shard evacuation has been successfully started.")
+
+	if awaitCompletion, _ := cmd.Flags().GetBool(awaitFlag); awaitCompletion {
+		noProgress, _ := cmd.Flags().GetBool(noProgressFlag)
+		waitEvacuateCompletion(cmd, pk, cli, !noProgress, true)
+	}
+}
+
+func getEvacuateShardStatus(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+	req := &control.GetShardEvacuationStatusRequest{
+		Body: &control.GetShardEvacuationStatusRequest_Body{},
+	}
+
+	signRequest(cmd, pk, req)
+
+	cli := getClient(cmd, pk)
+
+	var resp *control.GetShardEvacuationStatusResponse
+	var err error
+	err = cli.ExecRaw(func(client *client.Client) error {
+		resp, err = control.GetShardEvacuationStatus(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "Get evacuate shards status failed, rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	printStatus(cmd, resp)
+}
+
+func stopEvacuateShardStatus(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+	req := &control.StopShardEvacuationRequest{
+		Body: &control.StopShardEvacuationRequest_Body{},
+	}
+
+	signRequest(cmd, pk, req)
+
+	cli := getClient(cmd, pk)
+
+	var resp *control.StopShardEvacuationResponse
+	var err error
+	err = cli.ExecRaw(func(client *client.Client) error {
+		resp, err = control.StopShardEvacuation(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "Stop evacuate shards failed, rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	waitEvacuateCompletion(cmd, pk, cli, false, false)
+
+	cmd.Println("Evacuation stopped.")
+}
+
+func waitEvacuateCompletion(cmd *cobra.Command, pk *ecdsa.PrivateKey, cli *clientSDK.Client, printProgress, printCompleted bool) {
+	const statusPollingInterval = 1 * time.Second
+	const reportIntervalSeconds = 5
+	var resp *control.GetShardEvacuationStatusResponse
+	reportResponse := new(atomic.Pointer[control.GetShardEvacuationStatusResponse])
+	pollingCompleted := make(chan struct{})
+	progressReportCompleted := make(chan struct{})
+
+	go func() {
+		defer close(progressReportCompleted)
+		if !printProgress {
+			return
+		}
+		cmd.Printf("Progress will be reported every %d seconds.\n", reportIntervalSeconds)
+		for {
+			select {
+			case <-pollingCompleted:
+				return
+			case <-time.After(reportIntervalSeconds * time.Second):
+				r := reportResponse.Load()
+				if r == nil || r.GetBody().GetStatus() == control.GetShardEvacuationStatusResponse_Body_COMPLETED {
+					continue
+				}
+				printStatus(cmd, r)
+			}
+		}
+	}()
+
+	for {
+		req := &control.GetShardEvacuationStatusRequest{
+			Body: &control.GetShardEvacuationStatusRequest_Body{},
+		}
+		signRequest(cmd, pk, req)
+
+		var err error
+		err = cli.ExecRaw(func(client *client.Client) error {
+			resp, err = control.GetShardEvacuationStatus(client, req)
+			return err
+		})
+
+		reportResponse.Store(resp)
+
+		if err != nil {
+			commonCmd.ExitOnErr(cmd, "Failed to get evacuate status, rpc error: %w", err)
+			return
+		}
+		if resp.GetBody().GetStatus() != control.GetShardEvacuationStatusResponse_Body_RUNNING {
+			break
+		}
+
+		time.Sleep(statusPollingInterval)
+	}
+	close(pollingCompleted)
+	<-progressReportCompleted
+	if printCompleted {
+		printCompletedStatusMessage(cmd, resp)
+	}
+}
+
+func printCompletedStatusMessage(cmd *cobra.Command, resp *control.GetShardEvacuationStatusResponse) {
+	cmd.Println("Shard evacuation has been completed.")
+	sb := &strings.Builder{}
+	appendShardIDs(sb, resp)
+	appendCounts(sb, resp)
+	appendError(sb, resp)
+	appendStartedAt(sb, resp)
+	appendDuration(sb, resp)
+	cmd.Println(sb.String())
+}
+
+func printStatus(cmd *cobra.Command, resp *control.GetShardEvacuationStatusResponse) {
+	if resp.GetBody().GetStatus() == control.GetShardEvacuationStatusResponse_Body_EVACUATE_SHARD_STATUS_UNDEFINED {
+		cmd.Println("There is no running or completed evacuation.")
+		return
+	}
+	sb := &strings.Builder{}
+	appendShardIDs(sb, resp)
+	appendStatus(sb, resp)
+	appendCounts(sb, resp)
+	appendError(sb, resp)
+	appendStartedAt(sb, resp)
+	appendDuration(sb, resp)
+	appendEstimation(sb, resp)
+	cmd.Println(sb.String())
+}
+
+func appendEstimation(sb *strings.Builder, resp *control.GetShardEvacuationStatusResponse) {
+	if resp.GetBody().GetStatus() != control.GetShardEvacuationStatusResponse_Body_RUNNING ||
+		resp.GetBody().GetDuration() == nil ||
+		resp.GetBody().GetTotal() == 0 ||
+		resp.GetBody().GetEvacuated()+resp.GetBody().GetFailed()+resp.Body.GetSkipped() == 0 {
+		return
+	}
+
+	durationSeconds := float64(resp.GetBody().GetDuration().GetSeconds())
+	evacuated := float64(resp.GetBody().GetEvacuated() + resp.GetBody().GetFailed() + resp.GetBody().GetSkipped())
+	avgObjEvacuationTimeSeconds := durationSeconds / evacuated
+	objectsLeft := float64(resp.GetBody().GetTotal()) - evacuated
+	leftSeconds := avgObjEvacuationTimeSeconds * objectsLeft
+	leftMinutes := int(leftSeconds / 60)
+
+	sb.WriteString(fmt.Sprintf(" Estimated time left: %d minutes.", leftMinutes))
+}
+
+func appendDuration(sb *strings.Builder, resp *control.GetShardEvacuationStatusResponse) {
+	if resp.GetBody().GetDuration() != nil {
+		duration := time.Second * time.Duration(resp.GetBody().GetDuration().GetSeconds())
+		hour := int(duration.Seconds() / 3600)
+		minute := int(duration.Seconds()/60) % 60
+		second := int(duration.Seconds()) % 60
+		sb.WriteString(fmt.Sprintf(" Duration: %02d:%02d:%02d.", hour, minute, second))
+	}
+}
+
+func appendStartedAt(sb *strings.Builder, resp *control.GetShardEvacuationStatusResponse) {
+	if resp.GetBody().GetStartedAt() != nil {
+		startedAt := time.Unix(resp.GetBody().GetStartedAt().GetValue(), 0).UTC()
+		sb.WriteString(fmt.Sprintf(" Started at: %s UTC.", startedAt.Format(time.RFC3339)))
+	}
+}
+
+func appendError(sb *strings.Builder, resp *control.GetShardEvacuationStatusResponse) {
+	if len(resp.Body.GetErrorMessage()) > 0 {
+		sb.WriteString(fmt.Sprintf(" Error: %s.", resp.Body.GetErrorMessage()))
+	}
+}
+
+func appendStatus(sb *strings.Builder, resp *control.GetShardEvacuationStatusResponse) {
+	var status string
+	switch resp.GetBody().GetStatus() {
+	case control.GetShardEvacuationStatusResponse_Body_COMPLETED:
+		status = "completed"
+	case control.GetShardEvacuationStatusResponse_Body_RUNNING:
+		status = "running"
+	default:
+		status = "undefined"
+	}
+	sb.WriteString(fmt.Sprintf(" Status: %s.", status))
+}
+
+func appendShardIDs(sb *strings.Builder, resp *control.GetShardEvacuationStatusResponse) {
+	sb.WriteString("Shard IDs: ")
+	for idx, shardID := range resp.GetBody().GetShard_ID() {
+		shardIDStr := shard.NewIDFromBytes(shardID).String()
+		if idx > 0 {
+			sb.WriteString(", ")
+		}
+		sb.WriteString(shardIDStr)
+		if idx == len(resp.GetBody().GetShard_ID())-1 {
+			sb.WriteString(".")
+		}
+	}
+}
+
+func appendCounts(sb *strings.Builder, resp *control.GetShardEvacuationStatusResponse) {
+	sb.WriteString(fmt.Sprintf(" Evacuated %d objects out of %d, failed to evacuate: %d, skipped: %d.",
+		resp.GetBody().GetEvacuated(),
+		resp.GetBody().GetTotal(),
+		resp.GetBody().GetFailed(),
+		resp.GetBody().GetSkipped()))
+}
+
+func initControlEvacuationShardCmd() {
+	evacuationShardCmd.AddCommand(startEvacuationShardCmd)
+	evacuationShardCmd.AddCommand(getEvacuationShardStatusCmd)
+	evacuationShardCmd.AddCommand(stopEvacuationShardCmd)
+
+	initControlStartEvacuationShardCmd()
+	initControlFlags(getEvacuationShardStatusCmd)
+	initControlFlags(stopEvacuationShardCmd)
+}
+
+func initControlStartEvacuationShardCmd() {
+	initControlFlags(startEvacuationShardCmd)
+
+	flags := startEvacuationShardCmd.Flags()
+	flags.StringSlice(shardIDFlag, nil, "List of shard IDs in base58 encoding")
+	flags.Bool(shardAllFlag, false, "Process all shards")
+	flags.Bool(ignoreErrorsFlag, true, "Skip invalid/unreadable objects")
+	flags.Bool(awaitFlag, false, "Block execution until evacuation is completed")
+	flags.Bool(noProgressFlag, false, fmt.Sprintf("Print progress if %s provided", awaitFlag))
+
+	startEvacuationShardCmd.MarkFlagsMutuallyExclusive(shardIDFlag, shardAllFlag)
+}

cmd/frostfs-cli/modules/control/get_rule.go

@@ -0,0 +1,69 @@
+package control
+
+import (
+	"crypto/sha256"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
+	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
+	"github.com/spf13/cobra"
+)
+
+var getRuleCmd = &cobra.Command{
+	Use:   "get-rule",
+	Short: "Get local override",
+	Long:  "Get local APE override of the node",
+	Run:   getRule,
+}
+
+func getRule(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+
+	var cnr cid.ID
+	cidStr, _ := cmd.Flags().GetString(commonflags.CIDFlag)
+	commonCmd.ExitOnErr(cmd, "can't decode container ID: %w", cnr.DecodeString(cidStr))
+
+	rawCID := make([]byte, sha256.Size)
+	cnr.Encode(rawCID)
+
+	chainID, _ := cmd.Flags().GetString(chainIDFlag)
+
+	req := &control.GetChainLocalOverrideRequest{
+		Body: &control.GetChainLocalOverrideRequest_Body{
+			ContainerId: rawCID,
+			ChainId:     chainID,
+		},
+	}
+
+	signRequest(cmd, pk, req)
+
+	cli := getClient(cmd, pk)
+
+	var resp *control.GetChainLocalOverrideResponse
+	var err error
+	err = cli.ExecRaw(func(client *client.Client) error {
+		resp, err = control.GetChainLocalOverride(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	var chain apechain.Chain
+	commonCmd.ExitOnErr(cmd, "decode error: %w", chain.DecodeBytes(resp.GetBody().GetChain()))
+
+	// TODO (aarifullin): make pretty-formatted output for chains.
+	cmd.Println("Parsed chain:\n" + prettyJSONFormat(cmd, chain.Bytes()))
+}
+
+func initControGetRuleCmd() {
+	initControlFlags(getRuleCmd)
+
+	ff := getRuleCmd.Flags()
+	ff.String(commonflags.CIDFlag, "", commonflags.CIDFlagUsage)
+	ff.String(chainIDFlag, "", "Chain id")
+}

cmd/frostfs-cli/modules/control/healthcheck.go

@@ -1,15 +1,10 @@
 package control
 
 import (
-	"crypto/ecdsa"
-
 	rawclient "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
-	ircontrol "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir"
-	ircontrolsrv "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir/server"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"github.com/spf13/cobra"
 )
 
@@ -19,8 +14,8 @@ const (
 
 var healthCheckCmd = &cobra.Command{
 	Use:   "healthcheck",
-	Short: "Health check of the FrostFS node",
-	Long:  "Health check of the FrostFS node. Checks storage node by default, use --ir flag to work with Inner Ring.",
+	Short: "Health check for FrostFS storage nodes",
+	Long:  "Health check for FrostFS storage nodes.",
 	Run:   healthCheck,
 }
 
@@ -29,18 +24,18 @@ func initControlHealthCheckCmd() {
 
 	flags := healthCheckCmd.Flags()
 	flags.Bool(healthcheckIRFlag, false, "Communicate with IR node")
+	_ = flags.MarkDeprecated(healthcheckIRFlag, "for health check of inner ring nodes, use the 'control ir healthcheck' command instead.")
 }
 
-func healthCheck(cmd *cobra.Command, _ []string) {
-	pk := key.Get(cmd)
-
-	cli := getClient(cmd, pk)
-
+func healthCheck(cmd *cobra.Command, args []string) {
 	if isIR, _ := cmd.Flags().GetBool(healthcheckIRFlag); isIR {
-		healthCheckIR(cmd, pk, cli)
+		irHealthCheck(cmd, args)
 		return
 	}
 
+	pk := key.Get(cmd)
+	cli := getClient(cmd, pk)
+
 	req := new(control.HealthCheckRequest)
 	req.SetBody(new(control.HealthCheckRequest_Body))
 
@@ -59,23 +54,3 @@ func healthCheck(cmd *cobra.Command, _ []string) {
 	cmd.Printf("Network status: %s\n", resp.GetBody().GetNetmapStatus())
 	cmd.Printf("Health status: %s\n", resp.GetBody().GetHealthStatus())
 }
-
-func healthCheckIR(cmd *cobra.Command, key *ecdsa.PrivateKey, c *client.Client) {
-	req := new(ircontrol.HealthCheckRequest)
-
-	req.SetBody(new(ircontrol.HealthCheckRequest_Body))
-
-	err := ircontrolsrv.SignMessage(key, req)
-	commonCmd.ExitOnErr(cmd, "could not sign request: %w", err)
-
-	var resp *ircontrol.HealthCheckResponse
-	err = c.ExecRaw(func(client *rawclient.Client) error {
-		resp, err = ircontrol.HealthCheck(client, req)
-		return err
-	})
-	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
-
-	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
-
-	cmd.Printf("Health status: %s\n", resp.GetBody().GetHealthStatus())
-}

cmd/frostfs-cli/modules/control/ir.go

@@ -0,0 +1,34 @@
+package control
+
+import (
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"github.com/spf13/cobra"
+)
+
+var irCmd = &cobra.Command{
+	Use:   "ir",
+	Short: "Operations with inner ring nodes",
+	Long:  "Operations with inner ring nodes",
+}
+
+func initControlIRCmd() {
+	irCmd.AddCommand(tickEpochCmd)
+	irCmd.AddCommand(removeNodeCmd)
+	irCmd.AddCommand(irHealthCheckCmd)
+	irCmd.AddCommand(removeContainerCmd)
+
+	initControlIRTickEpochCmd()
+	initControlIRRemoveNodeCmd()
+	initControlIRHealthCheckCmd()
+	initControlIRRemoveContainerCmd()
+}
+
+func printVUB(cmd *cobra.Command, vub uint32) {
+	cmd.Printf("Transaction's valid until block is %d\n", vub)
+}
+
+func parseVUB(cmd *cobra.Command) uint32 {
+	vub, err := cmd.Flags().GetUint32(irFlagNameVUB)
+	commonCmd.ExitOnErr(cmd, "invalid valid until block value: %w", err)
+	return vub
+}

cmd/frostfs-cli/modules/control/ir_healthcheck.go

@@ -0,0 +1,44 @@
+package control
+
+import (
+	rawclient "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	ircontrol "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir"
+	ircontrolsrv "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir/server"
+	"github.com/spf13/cobra"
+)
+
+var irHealthCheckCmd = &cobra.Command{
+	Use:   "healthcheck",
+	Short: "Health check for FrostFS inner ring nodes",
+	Long:  "Health check for FrostFS inner ring nodes.",
+	Run:   irHealthCheck,
+}
+
+func initControlIRHealthCheckCmd() {
+	initControlFlags(irHealthCheckCmd)
+}
+
+func irHealthCheck(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+	cli := getClient(cmd, pk)
+
+	req := new(ircontrol.HealthCheckRequest)
+
+	req.SetBody(new(ircontrol.HealthCheckRequest_Body))
+
+	err := ircontrolsrv.SignMessage(pk, req)
+	commonCmd.ExitOnErr(cmd, "could not sign request: %w", err)
+
+	var resp *ircontrol.HealthCheckResponse
+	err = cli.ExecRaw(func(client *rawclient.Client) error {
+		resp, err = ircontrol.HealthCheck(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	cmd.Printf("Health status: %s\n", resp.GetBody().GetHealthStatus())
+}

cmd/frostfs-cli/modules/control/ir_remove_container.go

@@ -0,0 +1,93 @@
+package control
+
+import (
+	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/refs"
+	rawclient "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	ircontrol "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir"
+	ircontrolsrv "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir/server"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
+	"github.com/spf13/cobra"
+)
+
+const (
+	ownerFlag = "owner"
+)
+
+var removeContainerCmd = &cobra.Command{
+	Use:   "remove-container",
+	Short: "Schedules a container removal",
+	Long: `Schedules a container removal via a notary request.
+Container data will be deleted asynchronously by policer.
+To check removal status "frostfs-cli container list" command can be used.`,
+	Run: removeContainer,
+}
+
+func initControlIRRemoveContainerCmd() {
+	initControlIRFlags(removeContainerCmd)
+
+	flags := removeContainerCmd.Flags()
+	flags.String(commonflags.CIDFlag, "", commonflags.CIDFlagUsage)
+	flags.String(ownerFlag, "", "Container owner's wallet address.")
+	removeContainerCmd.MarkFlagsMutuallyExclusive(commonflags.CIDFlag, ownerFlag)
+	removeContainerCmd.MarkFlagsOneRequired(commonflags.CIDFlag, ownerFlag)
+}
+
+func removeContainer(cmd *cobra.Command, _ []string) {
+	req := prepareRemoveContainerRequest(cmd)
+
+	pk := key.Get(cmd)
+	c := getClient(cmd, pk)
+
+	commonCmd.ExitOnErr(cmd, "could not sign request: %w", ircontrolsrv.SignMessage(pk, req))
+
+	var resp *ircontrol.RemoveContainerResponse
+	err := c.ExecRaw(func(client *rawclient.Client) error {
+		var err error
+		resp, err = ircontrol.RemoveContainer(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "failed to execute request: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	if len(req.GetBody().GetContainerId()) > 0 {
+		cmd.Println("Container scheduled to removal")
+	} else {
+		cmd.Println("User containers sheduled to removal")
+	}
+	printVUB(cmd, resp.GetBody().GetVub())
+}
+
+func prepareRemoveContainerRequest(cmd *cobra.Command) *ircontrol.RemoveContainerRequest {
+	req := &ircontrol.RemoveContainerRequest{
+		Body: &ircontrol.RemoveContainerRequest_Body{},
+	}
+
+	cidStr, err := cmd.Flags().GetString(commonflags.CIDFlag)
+	commonCmd.ExitOnErr(cmd, "failed to get cid: ", err)
+
+	ownerStr, err := cmd.Flags().GetString(ownerFlag)
+	commonCmd.ExitOnErr(cmd, "failed to get owner: ", err)
+
+	if len(ownerStr) > 0 {
+		var owner user.ID
+		commonCmd.ExitOnErr(cmd, "invalid owner ID: %w", owner.DecodeString(ownerStr))
+		var ownerID refs.OwnerID
+		owner.WriteToV2(&ownerID)
+		req.Body.Owner = ownerID.StableMarshal(nil)
+	}
+
+	if len(cidStr) > 0 {
+		var containerID cid.ID
+		commonCmd.ExitOnErr(cmd, "invalid container ID: %w", containerID.DecodeString(cidStr))
+		req.Body.ContainerId = containerID[:]
+	}
+
+	req.Body.Vub = parseVUB(cmd)
+
+	return req
+}

cmd/frostfs-cli/modules/control/ir_remove_node.go

@@ -0,0 +1,60 @@
+package control
+
+import (
+	"encoding/hex"
+	"errors"
+
+	rawclient "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	ircontrol "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir"
+	ircontrolsrv "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir/server"
+	"github.com/spf13/cobra"
+)
+
+var removeNodeCmd = &cobra.Command{
+	Use:   "remove-node",
+	Short: "Forces a node removal from netmap",
+	Long:  "Forces a node removal from netmap via a notary request. It should be executed on other IR nodes as well.",
+	Run:   removeNode,
+}
+
+func initControlIRRemoveNodeCmd() {
+	initControlIRFlags(removeNodeCmd)
+
+	flags := removeNodeCmd.Flags()
+	flags.String("node", "", "Node public key as a hex string")
+	_ = removeNodeCmd.MarkFlagRequired("node")
+}
+
+func removeNode(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+	c := getClient(cmd, pk)
+
+	nodeKeyStr, _ := cmd.Flags().GetString("node")
+	if len(nodeKeyStr) == 0 {
+		commonCmd.ExitOnErr(cmd, "parsing node public key: ", errors.New("key cannot be empty"))
+	}
+	nodeKey, err := hex.DecodeString(nodeKeyStr)
+	commonCmd.ExitOnErr(cmd, "can't decode node public key: %w", err)
+
+	req := new(ircontrol.RemoveNodeRequest)
+	req.SetBody(&ircontrol.RemoveNodeRequest_Body{
+		Key: nodeKey,
+		Vub: parseVUB(cmd),
+	})
+
+	commonCmd.ExitOnErr(cmd, "could not sign request: %w", ircontrolsrv.SignMessage(pk, req))
+
+	var resp *ircontrol.RemoveNodeResponse
+	err = c.ExecRaw(func(client *rawclient.Client) error {
+		resp, err = ircontrol.RemoveNode(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	cmd.Println("Node removed")
+	printVUB(cmd, resp.GetBody().GetVub())
+}

cmd/frostfs-cli/modules/control/ir_tick_epoch.go

@@ -0,0 +1,46 @@
+package control
+
+import (
+	rawclient "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	ircontrol "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir"
+	ircontrolsrv "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control/ir/server"
+	"github.com/spf13/cobra"
+)
+
+var tickEpochCmd = &cobra.Command{
+	Use:   "tick-epoch",
+	Short: "Forces a new epoch",
+	Long:  "Forces a new epoch via a notary request. It should be executed on other IR nodes as well.",
+	Run:   tickEpoch,
+}
+
+func initControlIRTickEpochCmd() {
+	initControlIRFlags(tickEpochCmd)
+}
+
+func tickEpoch(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+	c := getClient(cmd, pk)
+
+	req := new(ircontrol.TickEpochRequest)
+	req.SetBody(&ircontrol.TickEpochRequest_Body{
+		Vub: parseVUB(cmd),
+	})
+
+	err := ircontrolsrv.SignMessage(pk, req)
+	commonCmd.ExitOnErr(cmd, "could not sign request: %w", err)
+
+	var resp *ircontrol.TickEpochResponse
+	err = c.ExecRaw(func(client *rawclient.Client) error {
+		resp, err = ircontrol.TickEpoch(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	cmd.Println("Epoch tick requested")
+	printVUB(cmd, resp.GetBody().GetVub())
+}

cmd/frostfs-cli/modules/control/list_rules.go

@@ -0,0 +1,72 @@
+package control
+
+import (
+	"crypto/sha256"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
+	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
+	"github.com/spf13/cobra"
+)
+
+var listRulesCmd = &cobra.Command{
+	Use:   "list-rules",
+	Short: "List local overrides",
+	Long:  "List local APE overrides of the node",
+	Run:   listRules,
+}
+
+func listRules(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+
+	var cnr cid.ID
+	cidStr, _ := cmd.Flags().GetString(commonflags.CIDFlag)
+	commonCmd.ExitOnErr(cmd, "can't decode container ID: %w", cnr.DecodeString(cidStr))
+
+	rawCID := make([]byte, sha256.Size)
+	cnr.Encode(rawCID)
+
+	req := &control.ListChainLocalOverridesRequest{
+		Body: &control.ListChainLocalOverridesRequest_Body{
+			ContainerId: rawCID,
+		},
+	}
+
+	signRequest(cmd, pk, req)
+
+	cli := getClient(cmd, pk)
+
+	var resp *control.ListChainLocalOverridesResponse
+	var err error
+	err = cli.ExecRaw(func(client *client.Client) error {
+		resp, err = control.ListChainLocalOverrides(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	chains := resp.GetBody().GetChains()
+	if len(chains) == 0 {
+		cmd.Println("Local overrides are not defined for the container.")
+		return
+	}
+
+	for _, c := range chains {
+		// TODO (aarifullin): make pretty-formatted output for chains.
+		var chain apechain.Chain
+		commonCmd.ExitOnErr(cmd, "decode error: %w", chain.DecodeBytes(c))
+		cmd.Println("Parsed chain:\n" + prettyJSONFormat(cmd, chain.Bytes()))
+	}
+}
+
+func initControlListRulesCmd() {
+	initControlFlags(listRulesCmd)
+
+	ff := listRulesCmd.Flags()
+	ff.String(commonflags.CIDFlag, "", commonflags.CIDFlagUsage)
+}

cmd/frostfs-cli/modules/control/remove_rule.go

@@ -0,0 +1,72 @@
+package control
+
+import (
+	"crypto/sha256"
+
+	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
+	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
+	"github.com/spf13/cobra"
+)
+
+const (
+	chainIDFlag = "chain-id"
+)
+
+var removeRuleCmd = &cobra.Command{
+	Use:   "remove-rule",
+	Short: "Remove local override",
+	Long:  "Remove local APE override of the node",
+	Run:   removeRule,
+}
+
+func removeRule(cmd *cobra.Command, _ []string) {
+	pk := key.Get(cmd)
+
+	var cnr cid.ID
+	cidStr, _ := cmd.Flags().GetString(commonflags.CIDFlag)
+	commonCmd.ExitOnErr(cmd, "can't decode container ID: %w", cnr.DecodeString(cidStr))
+
+	rawCID := make([]byte, sha256.Size)
+	cnr.Encode(rawCID)
+
+	chainID, _ := cmd.Flags().GetString(chainIDFlag)
+
+	req := &control.RemoveChainLocalOverrideRequest{
+		Body: &control.RemoveChainLocalOverrideRequest_Body{
+			ContainerId: rawCID,
+			ChainId:     chainID,
+		},
+	}
+
+	signRequest(cmd, pk, req)
+
+	cli := getClient(cmd, pk)
+
+	var resp *control.RemoveChainLocalOverrideResponse
+	var err error
+	err = cli.ExecRaw(func(client *client.Client) error {
+		resp, err = control.RemoveChainLocalOverride(client, req)
+		return err
+	})
+	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
+
+	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
+
+	if resp.GetBody().Removed {
+		cmd.Println("Rule has been removed.")
+	} else {
+		cmd.Println("Rule has not been removed.")
+	}
+}
+
+func initControlRemoveRuleCmd() {
+	initControlFlags(removeRuleCmd)
+
+	ff := removeRuleCmd.Flags()
+	ff.String(commonflags.CIDFlag, "", commonflags.CIDFlagUsage)
+	ff.String(chainIDFlag, "", "Chain id")
+}

cmd/frostfs-cli/modules/control/root.go

@@ -33,6 +33,11 @@ func init() {
 		dropObjectsCmd,
 		shardsCmd,
 		synchronizeTreeCmd,
+		irCmd,
+		addRuleCmd,
+		removeRuleCmd,
+		listRulesCmd,
+		getRuleCmd,
 	)
 
 	initControlHealthCheckCmd()
@@ -40,4 +45,9 @@ func init() {
 	initControlDropObjectsCmd()
 	initControlShardsCmd()
 	initControlSynchronizeTreeCmd()
+	initControlIRCmd()
+	initControlAddRuleCmd()
+	initControlRemoveRuleCmd()
+	initControlListRulesCmd()
+	initControGetRuleCmd()
 }

cmd/frostfs-cli/modules/control/shards.go

@@ -13,17 +13,15 @@ var shardsCmd = &cobra.Command{
 func initControlShardsCmd() {
 	shardsCmd.AddCommand(listShardsCmd)
 	shardsCmd.AddCommand(setShardModeCmd)
-	shardsCmd.AddCommand(dumpShardCmd)
-	shardsCmd.AddCommand(restoreShardCmd)
 	shardsCmd.AddCommand(evacuateShardCmd)
+	shardsCmd.AddCommand(evacuationShardCmd)
 	shardsCmd.AddCommand(flushCacheCmd)
 	shardsCmd.AddCommand(doctorCmd)
 
 	initControlShardsListCmd()
 	initControlSetShardModeCmd()
-	initControlDumpShardCmd()
-	initControlRestoreShardCmd()
 	initControlEvacuateShardCmd()
+	initControlEvacuationShardCmd()
 	initControlFlushCacheCmd()
 	initControlDoctorCmd()
 }

cmd/frostfs-cli/modules/control/shards_dump.go

@@ -1,66 +0,0 @@
-package control
-
-import (
-	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
-	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
-	"github.com/spf13/cobra"
-)
-
-const (
-	dumpFilepathFlag     = "path"
-	dumpIgnoreErrorsFlag = "no-errors"
-)
-
-var dumpShardCmd = &cobra.Command{
-	Use:   "dump",
-	Short: "Dump objects from shard",
-	Long:  "Dump objects from shard to a file",
-	Run:   dumpShard,
-}
-
-func dumpShard(cmd *cobra.Command, _ []string) {
-	pk := key.Get(cmd)
-
-	body := new(control.DumpShardRequest_Body)
-	body.SetShardID(getShardID(cmd))
-
-	p, _ := cmd.Flags().GetString(dumpFilepathFlag)
-	body.SetFilepath(p)
-
-	ignore, _ := cmd.Flags().GetBool(dumpIgnoreErrorsFlag)
-	body.SetIgnoreErrors(ignore)
-
-	req := new(control.DumpShardRequest)
-	req.SetBody(body)
-
-	signRequest(cmd, pk, req)
-
-	cli := getClient(cmd, pk)
-
-	var resp *control.DumpShardResponse
-	var err error
-	err = cli.ExecRaw(func(client *client.Client) error {
-		resp, err = control.DumpShard(client, req)
-		return err
-	})
-	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
-
-	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
-
-	cmd.Println("Shard has been dumped successfully.")
-}
-
-func initControlDumpShardCmd() {
-	initControlFlags(dumpShardCmd)
-
-	flags := dumpShardCmd.Flags()
-	flags.String(shardIDFlag, "", "Shard ID in base58 encoding")
-	flags.String(dumpFilepathFlag, "", "File to write objects to")
-	flags.Bool(dumpIgnoreErrorsFlag, false, "Skip invalid/unreadable objects")
-
-	_ = dumpShardCmd.MarkFlagRequired(shardIDFlag)
-	_ = dumpShardCmd.MarkFlagRequired(dumpFilepathFlag)
-	_ = dumpShardCmd.MarkFlagRequired(controlRPC)
-}

cmd/frostfs-cli/modules/control/shards_list.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 
 	rawclient "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
@@ -49,11 +50,14 @@ func listShards(cmd *cobra.Command, _ []string) {
 
 	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
 
+	shards := resp.GetBody().GetShards()
+	sortShardsByID(shards)
+
 	isJSON, _ := cmd.Flags().GetBool(commonflags.JSON)
 	if isJSON {
-		prettyPrintShardsJSON(cmd, resp.GetBody().GetShards())
+		prettyPrintShardsJSON(cmd, shards)
 	} else {
-		prettyPrintShards(cmd, resp.GetBody().GetShards())
+		prettyPrintShards(cmd, shards)
 	}
 }
 
@@ -115,3 +119,9 @@ func shardModeToString(m control.ShardMode) string {
 
 	return "unknown"
 }
+
+func sortShardsByID(ii []*control.ShardInfo) {
+	sort.Slice(ii, func(i, j int) bool {
+		return bytes.Compare(ii[i].Shard_ID, ii[j].Shard_ID) < 0
+	})
+}

cmd/frostfs-cli/modules/control/shards_restore.go

@@ -1,66 +0,0 @@
-package control
-
-import (
-	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
-	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
-	"github.com/spf13/cobra"
-)
-
-const (
-	restoreFilepathFlag     = "path"
-	restoreIgnoreErrorsFlag = "no-errors"
-)
-
-var restoreShardCmd = &cobra.Command{
-	Use:   "restore",
-	Short: "Restore objects from shard",
-	Long:  "Restore objects from shard to a file",
-	Run:   restoreShard,
-}
-
-func restoreShard(cmd *cobra.Command, _ []string) {
-	pk := key.Get(cmd)
-
-	body := new(control.RestoreShardRequest_Body)
-	body.SetShardID(getShardID(cmd))
-
-	p, _ := cmd.Flags().GetString(restoreFilepathFlag)
-	body.SetFilepath(p)
-
-	ignore, _ := cmd.Flags().GetBool(restoreIgnoreErrorsFlag)
-	body.SetIgnoreErrors(ignore)
-
-	req := new(control.RestoreShardRequest)
-	req.SetBody(body)
-
-	signRequest(cmd, pk, req)
-
-	cli := getClient(cmd, pk)
-
-	var resp *control.RestoreShardResponse
-	var err error
-	err = cli.ExecRaw(func(client *client.Client) error {
-		resp, err = control.RestoreShard(client, req)
-		return err
-	})
-	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
-
-	verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
-
-	cmd.Println("Shard has been restored successfully.")
-}
-
-func initControlRestoreShardCmd() {
-	initControlFlags(restoreShardCmd)
-
-	flags := restoreShardCmd.Flags()
-	flags.String(shardIDFlag, "", "Shard ID in base58 encoding")
-	flags.String(restoreFilepathFlag, "", "File to read objects from")
-	flags.Bool(restoreIgnoreErrorsFlag, false, "Skip invalid/unreadable objects")
-
-	_ = restoreShardCmd.MarkFlagRequired(shardIDFlag)
-	_ = restoreShardCmd.MarkFlagRequired(restoreFilepathFlag)
-	_ = restoreShardCmd.MarkFlagRequired(controlRPC)
-}

cmd/frostfs-cli/modules/control/shards_set_mode.go

@@ -1,7 +1,9 @@
 package control
 
 import (
+	"bytes"
 	"fmt"
+	"sort"
 	"strings"
 
 	rawclient "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
@@ -137,13 +139,6 @@ func setShardMode(cmd *cobra.Command, _ []string) {
 	cmd.Println("Shard mode update request successfully sent.")
 }
 
-func getShardID(cmd *cobra.Command) []byte {
-	sid, _ := cmd.Flags().GetString(shardIDFlag)
-	raw, err := base58.Decode(sid)
-	commonCmd.ExitOnErr(cmd, "incorrect shard ID encoding: %w", err)
-	return raw
-}
-
 func getShardIDList(cmd *cobra.Command) [][]byte {
 	all, _ := cmd.Flags().GetBool(shardAllFlag)
 	if all {
@@ -174,5 +169,9 @@ func getShardIDList(cmd *cobra.Command) [][]byte {
 		res = append(res, raw)
 	}
 
+	sort.Slice(res, func(i, j int) bool {
+		return bytes.Compare(res[i], res[j]) < 0
+	})
+
 	return res
 }

cmd/frostfs-cli/modules/control/util.go

@@ -14,6 +14,10 @@ import (
 	"github.com/spf13/cobra"
 )
 
+const (
+	irFlagNameVUB = "vub"
+)
+
 func initControlFlags(cmd *cobra.Command) {
 	ff := cmd.Flags()
 	ff.StringP(commonflags.WalletPath, commonflags.WalletPathShorthand, commonflags.WalletPathDefault, commonflags.WalletPathUsage)
@@ -22,6 +26,13 @@ func initControlFlags(cmd *cobra.Command) {
 	ff.DurationP(commonflags.Timeout, commonflags.TimeoutShorthand, commonflags.TimeoutDefault, commonflags.TimeoutUsage)
 }
 
+func initControlIRFlags(cmd *cobra.Command) {
+	initControlFlags(cmd)
+
+	ff := cmd.Flags()
+	ff.Uint32(irFlagNameVUB, 0, "Valid until block value for notary transaction")
+}
+
 func signRequest(cmd *cobra.Command, pk *ecdsa.PrivateKey, req controlSvc.SignedMessage) {
 	err := controlSvc.SignMessage(pk, req)
 	commonCmd.ExitOnErr(cmd, "could not sign request: %w", err)
@@ -40,7 +51,7 @@ func verifyResponse(cmd *cobra.Command,
 		commonCmd.ExitOnErr(cmd, "", errors.New("missing response signature"))
 	}
 
-	// TODO(@cthulhu-rider): #1387 use Signature message from NeoFS API to avoid conversion
+	// TODO(@cthulhu-rider): #468 use Signature message from FrostFS API to avoid conversion
 	var sigV2 refs.Signature
 	sigV2.SetScheme(refs.ECDSA_SHA512)
 	sigV2.SetKey(sigControl.GetKey())

cmd/frostfs-cli/modules/netmap/get_epoch.go

@@ -16,10 +16,11 @@ var getEpochCmd = &cobra.Command{
 		p := key.GetOrGenerate(cmd)
 		cli := internalclient.GetSDKClientByFlag(cmd, p, commonflags.RPC)
 
-		var prm internalclient.NetworkInfoPrm
-		prm.SetClient(cli)
+		prm := internalclient.NetworkInfoPrm{
+			Client: cli,
+		}
 
-		res, err := internalclient.NetworkInfo(prm)
+		res, err := internalclient.NetworkInfo(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		netInfo := res.NetworkInfo()

cmd/frostfs-cli/modules/netmap/netinfo.go

@@ -20,10 +20,11 @@ var netInfoCmd = &cobra.Command{
 		p := key.GetOrGenerate(cmd)
 		cli := internalclient.GetSDKClientByFlag(cmd, p, commonflags.RPC)
 
-		var prm internalclient.NetworkInfoPrm
-		prm.SetClient(cli)
+		prm := internalclient.NetworkInfoPrm{
+			Client: cli,
+		}
 
-		res, err := internalclient.NetworkInfo(prm)
+		res, err := internalclient.NetworkInfo(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		netInfo := res.NetworkInfo()
@@ -38,11 +39,7 @@ var netInfoCmd = &cobra.Command{
 		const format = "  %s: %v\n"
 
 		cmd.Println("FrostFS network configuration (system)")
-		cmd.Printf(format, "Audit fee", netInfo.AuditFee())
-		cmd.Printf(format, "Storage price", netInfo.StoragePrice())
 		cmd.Printf(format, "Container fee", netInfo.ContainerFee())
-		cmd.Printf(format, "EigenTrust alpha", netInfo.EigenTrustAlpha())
-		cmd.Printf(format, "Number of EigenTrust iterations", netInfo.NumberOfEigenTrustIterations())
 		cmd.Printf(format, "Epoch duration", netInfo.EpochDuration())
 		cmd.Printf(format, "Inner Ring candidate fee", netInfo.IRCandidateFee())
 		cmd.Printf(format, "Maximum object size", netInfo.MaxObjectSize())

cmd/frostfs-cli/modules/netmap/nodeinfo.go

@@ -22,10 +22,11 @@ var nodeInfoCmd = &cobra.Command{
 		p := key.GetOrGenerate(cmd)
 		cli := internalclient.GetSDKClientByFlag(cmd, p, commonflags.RPC)
 
-		var prm internalclient.NodeInfoPrm
-		prm.SetClient(cli)
+		prm := internalclient.NodeInfoPrm{
+			Client: cli,
+		}
 
-		res, err := internalclient.NodeInfo(prm)
+		res, err := internalclient.NodeInfo(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		prettyPrintNodeInfo(cmd, res.NodeInfo())

cmd/frostfs-cli/modules/netmap/snapshot.go

@@ -19,7 +19,7 @@ var snapshotCmd = &cobra.Command{
 		var prm internalclient.NetMapSnapshotPrm
 		prm.SetClient(cli)
 
-		res, err := internalclient.NetMapSnapshot(prm)
+		res, err := internalclient.NetMapSnapshot(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		commonCmd.PrettyPrintNetMap(cmd, res.NetMap(), false)

cmd/frostfs-cli/modules/object/delete.go

@@ -65,7 +65,7 @@ func deleteObject(cmd *cobra.Command, _ []string) {
 	Prepare(cmd, &prm)
 	prm.SetAddress(objAddr)
 
-	res, err := internalclient.DeleteObject(prm)
+	res, err := internalclient.DeleteObject(cmd.Context(), prm)
 	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 	tomb := res.Tombstone()

cmd/frostfs-cli/modules/object/get.go

@@ -11,7 +11,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
+	objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"github.com/cheggaaa/pb"
 	"github.com/spf13/cobra"
@@ -84,13 +84,13 @@ func getObject(cmd *cobra.Command, _ []string) {
 		p = pb.New64(0)
 		p.Output = cmd.OutOrStdout()
 		prm.SetPayloadWriter(p.NewProxyWriter(payloadWriter))
-		prm.SetHeaderCallback(func(o *object.Object) {
+		prm.SetHeaderCallback(func(o *objectSDK.Object) {
 			p.SetTotal64(int64(o.PayloadSize()))
 			p.Start()
 		})
 	}
 
-	res, err := internalclient.GetObject(prm)
+	res, err := internalclient.GetObject(cmd.Context(), prm)
 	if p != nil {
 		p.Finish()
 	}
@@ -132,7 +132,7 @@ func createOutWriter(cmd *cobra.Command, filename string) (out io.Writer, closer
 		out = os.Stdout
 		closer = func() {}
 	} else {
-		f, err := os.OpenFile(filename, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
+		f, err := os.OpenFile(filename, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
 		if err != nil {
 			commonCmd.ExitOnErr(cmd, "", fmt.Errorf("can't open file '%s': %w", filename, err))
 		}

cmd/frostfs-cli/modules/object/hash.go

@@ -75,7 +75,7 @@ func getObjectHash(cmd *cobra.Command, _ []string) {
 		headPrm.SetAddress(objAddr)
 
 		// get hash of full payload through HEAD (may be user can do it through dedicated command?)
-		res, err := internalclient.HeadObject(headPrm)
+		res, err := internalclient.HeadObject(cmd.Context(), headPrm)
 		commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 		var cs checksum.Checksum
@@ -108,7 +108,7 @@ func getObjectHash(cmd *cobra.Command, _ []string) {
 		hashPrm.TZ()
 	}
 
-	res, err := internalclient.HashPayloadRanges(hashPrm)
+	res, err := internalclient.HashPayloadRanges(cmd.Context(), hashPrm)
 	commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
 
 	hs := res.HashList()

cmd/frostfs-cli/modules/object/head.go

@@ -13,7 +13,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
 	commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
+	objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"github.com/spf13/cobra"
 )
@@ -64,7 +64,7 @@ func getObjectHeader(cmd *cobra.Command, _ []string) {
 	prm.SetAddress(objAddr)
 	prm.SetMainOnlyFlag(mainOnly)
 
-	res, err := internalclient.HeadObject(prm)
+	res, err := internalclient.HeadObject(cmd.Context(), prm)
 	if err != nil {
 		if ok := printSplitInfoErr(cmd, err); ok {
 			return
@@ -77,7 +77,7 @@ func getObjectHeader(cmd *cobra.Command, _ []string) {
 	commonCmd.ExitOnErr(cmd, "", err)
 }
 
-func saveAndPrintHeader(cmd *cobra.Command, obj *object.Object, filename string) error {
+func saveAndPrintHeader(cmd *cobra.Command, obj *objectSDK.Object, filename string) error {
 	bs, err := marshalHeader(cmd, obj)
 	if err != nil {
 		return fmt.Errorf("could not marshal header: %w", err)
@@ -97,7 +97,7 @@ func saveAndPrintHeader(cmd *cobra.Command, obj *object.Object, filename string)
 	return printHeader(cmd, obj)
 }
 
-func marshalHeader(cmd *cobra.Command, hdr *object.Object) ([]byte, error) {
+func marshalHeader(cmd *cobra.Command, hdr *objectSDK.Object) ([]byte, error) {
 	toJSON, _ := cmd.Flags().GetBool(commonflags.JSON)
 	toProto, _ := cmd.Flags().GetBool("proto")
 	switch {
@@ -138,7 +138,7 @@ func printContainerID(cmd *cobra.Command, recv func() (cid.ID, bool)) {
 	cmd.Printf("CID: %s\n", strID)
 }
 
-func printHeader(cmd *cobra.Command, obj *object.Object) error {
+func printHeader(cmd *cobra.Command, obj *objectSDK.Object) error {
 	printObjectID(cmd, obj.ID)
 	printContainerID(cmd, obj.ContainerID)
 	cmd.Printf("Owner: %s\n", obj.OwnerID())
@@ -150,7 +150,7 @@ func printHeader(cmd *cobra.Command, obj *object.Object) error {
 
 	cmd.Println("Attributes:")
 	for _, attr := range obj.Attributes() {
-		if attr.Key() == object.AttributeTimestamp {
+		if attr.Key() == objectSDK.AttributeTimestamp {
 			cmd.Printf("  %s=%s (%s)\n",
 				attr.Key(),
 				attr.Value(),
@@ -163,7 +163,7 @@ func printHeader(cmd *cobra.Command, obj *object.Object) error {
 	if signature := obj.Signature(); signature != nil {
 		cmd.Print("ID signature:\n")
 
-		// TODO(@carpawell): #1387 implement and use another approach to avoid conversion
+		// TODO(@carpawell): #468 implement and use another approach to avoid conversion
 		var sigV2 refs.Signature
 		signature.WriteToV2(&sigV2)
 
@@ -174,7 +174,7 @@ func printHeader(cmd *cobra.Command, obj *object.Object) error {
 	return printSplitHeader(cmd, obj)
 }
 
-func printSplitHeader(cmd *cobra.Command, obj *object.Object) error {
+func printSplitHeader(cmd *cobra.Command, obj *objectSDK.Object) error {
 	if splitID := obj.SplitID(); splitID != nil {
 		cmd.Printf("Split ID: %s\n", splitID)
 	}

cmd/frostfs-cli/modules/object/lock.go

@@ -94,7 +94,7 @@ var objectLockCmd = &cobra.Command{
 
 		obj := objectSDK.New()
 		obj.SetContainerID(cnr)
-		obj.SetOwnerID(&idOwner)
+		obj.SetOwnerID(idOwner)
 		obj.SetType(objectSDK.TypeLock)
 		obj.SetAttributes(expirationAttr)
 		obj.SetPayload(lock.Marshal())
@@ -104,7 +104,7 @@ var objectLockCmd = &cobra.Command{
 		Prepare(cmd, &prm)
 		prm.SetHeader(obj)
 
-		res, err := internalclient.PutObject(prm)
+		res, err := internalclient.PutObject(cmd.Context(), prm)
 		commonCmd.ExitOnErr(cmd, "Store lock object in FrostFS: %w", err)
 
 		cmd.Printf("Lock object ID: %s\n", res.ID())