Looks nice. When I did something similar (with no intention to make reusable though) I found I sometimes needed 4 validation rule sets (input on create/update and database data on create/update). A simplified example could be User and Password. Input data are 'login', 'password' and 'password confirmation' with rules for passwords however for database data you have got 'login' and 'password_hash'. Same for update.

@neomerx Things like password confirmation are applicable basically only during http request, when you're submitting a form, so there's no problem to do something like this:

// Form Request
public function rules()
{
   return array_merge(
        User::getCreateRules(), 
        ['password' => 'confirmed']
   );
}

Sure. However when you have all your rules in models and then you have to have some of them outside (e.g. in forms) you start thinking what you should do with it. So did I ;) Anyway you did a big job on coverage and fixing pesky scrutinizer issues :) Keep going, man