The 'matches' validation rule fails even though I'm sure its correct

The issue here is that you have setPassword() which sets password_hash and then your rule in model is trying to match $attributes['password'] with $attributes['password-confirm'] the issue is that your entity contains $attributes['password_hash'] and not $attributes['password'] just note that validation in model class will be working with $attributes array which can be modified with setters so you should either hash the 'password-confirm' and match is with 'password_hash' or set the not hashed password in $attributes['password'] as well in the setter.