This is the answer.
The fragments produced by WSRP and JSR168 must be valid HTMLor XHTML
fragments (depending on the content type of the request) but other than
that no special syntax is mandated by the specs.
The URLs however that are included in the markup and that semanatically
point back to the portlet (e.g. as an action or a render URL) need to
comply with some rules:
JSR168: all action/render URLs must be generated via the JSR168 API. No
assumption about the structure of these URL must be made, they need to be
written as-is onto the output stream
WSRP: all action/render URLs need to either use rewriting templates or
syntactically match the rewrite URL format as defined by the specification.