diff --git a/cli/app/backup.go b/cli/app/backup.go
index 75d9eb6b..a44609a2 100644
--- a/cli/app/backup.go
+++ b/cli/app/backup.go
@@ -48,26 +48,10 @@ var appBackupListCommand = cli.Command{
 		app := internal.ValidateApp(c)
 
 		r := recipe.Get2(app.Recipe)
-		if err := r.EnsureExists(); err != nil {
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		cl, err := client.New(app.Server)
 		if err != nil {
 			log.Fatal(err)
diff --git a/cli/app/check.go b/cli/app/check.go
index 002a2978..fe87298e 100644
--- a/cli/app/check.go
+++ b/cli/app/check.go
@@ -36,28 +36,12 @@ ${FOO:<default>} syntax). "check" does not confirm or deny this for you.`,
 	BashComplete: autocomplete.AppNameComplete,
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
+
 		r := recipe.Get2(app.Recipe)
-
-		if err := r.EnsureExists(); err != nil {
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		tableCol := []string{"recipe env sample", "app env"}
 		table := formatter.CreateTable(tableCol)
 
diff --git a/cli/app/cmd.go b/cli/app/cmd.go
index a92dc946..33cec9a8 100644
--- a/cli/app/cmd.go
+++ b/cli/app/cmd.go
@@ -59,28 +59,12 @@ Example:
 	},
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
-		r := recipe.Get2(app.Name)
 
-		if err := r.EnsureExists(); err != nil {
+		r := recipe.Get2(app.Recipe)
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		if internal.LocalCmd && internal.RemoteUser != "" {
 			internal.ShowSubcommandHelpAndError(c, errors.New("cannot use --local & --user together"))
 		}
diff --git a/cli/app/deploy.go b/cli/app/deploy.go
index 27716276..138e0330 100644
--- a/cli/app/deploy.go
+++ b/cli/app/deploy.go
@@ -52,33 +52,17 @@ recipes.
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
 		stackName := app.StackName()
-		r2 := recipe.Get2(app.Recipe)
 
 		specificVersion := c.Args().Get(1)
 		if specificVersion != "" && internal.Chaos {
 			log.Fatal("cannot use <version> and --chaos together")
 		}
 
-		if err := r2.EnsureExists(); err != nil {
+		r2 := recipe.Get2(app.Recipe)
+		if err := r2.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r2.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r2.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r2.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		r, err := recipe.Get(app.Recipe, internal.Offline)
 		if err != nil {
 			log.Fatal(err)
diff --git a/cli/app/restore.go b/cli/app/restore.go
index b6605d29..5f3c30ce 100644
--- a/cli/app/restore.go
+++ b/cli/app/restore.go
@@ -32,28 +32,12 @@ var appRestoreCommand = cli.Command{
 	BashComplete: autocomplete.AppNameComplete,
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
+
 		r := recipe.Get2(app.Recipe)
-
-		if err := r.EnsureExists(); err != nil {
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		cl, err := client.New(app.Server)
 		if err != nil {
 			log.Fatal(err)
diff --git a/cli/app/rollback.go b/cli/app/rollback.go
index 82eae9cc..edade3d0 100644
--- a/cli/app/rollback.go
+++ b/cli/app/rollback.go
@@ -52,33 +52,17 @@ recipes.
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
 		stackName := app.StackName()
-		r2 := recipe.Get2(app.Recipe)
 
 		specificVersion := c.Args().Get(1)
 		if specificVersion != "" && internal.Chaos {
 			log.Fatal("cannot use <version> and --chaos together")
 		}
 
-		if err := r2.EnsureExists(); err != nil {
+		r2 := recipe.Get2(app.Recipe)
+		if err := r2.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r2.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r2.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r2.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		r, err := recipe.Get(app.Recipe, internal.Offline)
 		if err != nil {
 			log.Fatal(err)
diff --git a/cli/app/secret.go b/cli/app/secret.go
index 0f995fd0..22ad9e9d 100644
--- a/cli/app/secret.go
+++ b/cli/app/secret.go
@@ -56,28 +56,12 @@ var appSecretGenerateCommand = cli.Command{
 	BashComplete: autocomplete.AppNameComplete,
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
+
 		r := recipe.Get2(app.Recipe)
-
-		if err := r.EnsureExists(); err != nil {
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		if len(c.Args()) == 1 && !allSecrets {
 			err := errors.New("missing arguments <secret>/<version> or '--all'")
 			internal.ShowSubcommandHelpAndError(c, err)
diff --git a/cli/app/upgrade.go b/cli/app/upgrade.go
index f4d2bf85..fe61d5be 100644
--- a/cli/app/upgrade.go
+++ b/cli/app/upgrade.go
@@ -58,27 +58,15 @@ recipes.
 	Action: func(c *cli.Context) error {
 		app := internal.ValidateApp(c)
 		stackName := app.StackName()
-		r := recipe.Get2(app.Name)
 
 		specificVersion := c.Args().Get(1)
 		if specificVersion != "" && internal.Chaos {
 			log.Fatal("cannot use <version> and --chaos together")
 		}
 
-		if !internal.Chaos {
-			if err := r.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
+		r := recipe.Get2(app.Recipe)
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
+			log.Fatal(err)
 		}
 
 		recipe, err := recipePkg.Get(app.Recipe, internal.Offline)
diff --git a/cli/recipe/lint.go b/cli/recipe/lint.go
index ecddc12b..079a0a53 100644
--- a/cli/recipe/lint.go
+++ b/cli/recipe/lint.go
@@ -28,28 +28,12 @@ var recipeLintCommand = cli.Command{
 	BashComplete: autocomplete.RecipeNameComplete,
 	Action: func(c *cli.Context) error {
 		recipe := internal.ValidateRecipe(c)
+
 		r := recipePkg.Get2(recipe.Name)
-
-		if err := r.EnsureExists(); err != nil {
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}
 
-		if !internal.Chaos {
-			if err := r.EnsureIsClean(); err != nil {
-				log.Fatal(err)
-			}
-
-			if !internal.Offline {
-				if err := r.EnsureUpToDate(); err != nil {
-					log.Fatal(err)
-				}
-			}
-
-			if err := r.EnsureLatest(); err != nil {
-				log.Fatal(err)
-			}
-		}
-
 		tableCol := []string{"ref", "rule", "severity", "satisfied", "skipped", "resolve"}
 		table := formatter.CreateTable(tableCol)
 
diff --git a/cli/recipe/upgrade.go b/cli/recipe/upgrade.go
index f51d5a96..bd8f339a 100644
--- a/cli/recipe/upgrade.go
+++ b/cli/recipe/upgrade.go
@@ -72,21 +72,9 @@ You may invoke this command in "wizard" mode and be prompted for input:
 	BashComplete: autocomplete.RecipeNameComplete,
 	Action: func(c *cli.Context) error {
 		recipe := internal.ValidateRecipe(c)
+
 		r := recipePkg.Get2(recipe.Name)
-
-		if err := r.EnsureIsClean(); err != nil {
-			log.Fatal(err)
-		}
-
-		if err := r.EnsureExists(); err != nil {
-			log.Fatal(err)
-		}
-
-		if err := r.EnsureUpToDate(); err != nil {
-			log.Fatal(err)
-		}
-
-		if err := r.EnsureLatest(); err != nil {
+		if err := r.Ensure(internal.Chaos, internal.Offline); err != nil {
 			log.Fatal(err)
 		}