Came up short locating a talk by Miller on Caja. Ward explained Wiki uses Caja to sanitize JavaScript, that Caja means box in Spanish pronounced 'ca-ha' page 
. Hence this fun video, and this standards talk.
YOUTUBE r8TbBzVbdUg Published on Nov 26, 2016
YOUTUBE Kq4FpMe6cRs Google Tech Talk May 18, 2009
Even finding the Caja specification takes some searching because Google decremented
The spec is missing at Google because Googlecode was discontinued.page
I'm trying to locate the PDF, not a link to the PDF (inside a walled garden). Please update if you find PDF. http://google-caja.googlecode.com/files/caja-spec-2008-06-07.pdf
*The earliest version of the PDF was archived on 26th March 2009, by archive.org. At that stage the related work had not been written, later versions in the archive also have that section missing, and there does not appear to be a later version of the spec in the archive. pdf *
Caja continues at developers.google.com bereft spec. page
Caja Test Bed c/o Google code cajadores
.
One of the earliest community hackathons at Google leading into GTUG later GDG was on OpenSocial. W/o Caja developers were able to extract lists of data from Facebook and insert into MySpace...mission impossible accomplished. Did this hacking inspire Mark Miller?
YOUTUBE mGWwpz7OINc Early community OpenSocial hackathon at Google