I've struggled with this as well. While open bugs (and length of time open) seems like a useful metric, that would be a problem if management regularly tells development to not work on bugs (new features instead). I suppose that could work if you had some way of marking the bug as "blocked by management" or something.
Cycle time measurement would be wonderful. But that would seem to require 1) a reliable and fast build/QA/Release pipeline and 2) either consistent-sized "chunks" of work or a weighting factor. We're working on getting the former right, and the latter seems like it could be gamed in either direction.
Another issue that comes up is how do you deal with KPIs impacting salary when your environment trends towards chaos? For instance, if you have a big client who must be pleased - should they find something that displeases them, it could easily pull people off of other work until they are happy again. If KPIs are based on cycle time, now developers are being penalized simply because the client exists and has more leverage than the development team.
I'm wondering if KPIs are the answer, rather than simply having rewards at milestones.
One concern I have with a KPI-based approach is how to deal with efficiency improvements. Say the team figures out how to double the amount of work they can reasonably do in a sprint (for example). Now that's the new baseline, so now it becomes harder to improve one's personal KPIs to stand out. Done badly, the team ends up caught under a productivity asymptote and feels less motivated rather than more.
Another concern with individual KPIs is how they can sometimes cause the team not to work together. A senior dev under a bad KPI system might be incentivized not to mentor and support the junior devs, because doing so damages their KPIs in favor of the juniors.
Team-based KPIs can lead to resentment too, as some team members won't carry their weight and will end up being resented.
I've really been thinking about this a lot lately and the harder I look, the fewer answers I have that might be correct. Thank you for responding and thanks to OP for asking the original question - it comes at a perfect time for me.